Re: [PATCH net v5 4/8] ipv4: icmp: don't quote decrypted payload in icmp errors

[sashiko-bot@kernel.org]

> an icmp error quotes as much of the invoking packet as fits in 576
> bytes. if the device had decrypted the packet (as indicated by
> skb->decrypted) then the icmp error is sending part of it back out onto
> the network in cleartext.
> 
> the two offloads encrypt different parts of the packet:
> 
> - ktls encrypts the tcp payload. the tcp header is in the clear on the
>   wire, so a quote of the ip header and the tcp header, without the
>   payload, would be fine.
> 
> - psp encryption also covers the tcp header. the quote could include
>   just the ip header, but then that's not really useful. linux receivers
>   want to look at the l4 layer on the quoted packet to look up the
>   related flow, so such a truncated icmp error packet is just dropped
> [ ... ]
> Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261023234640.1459291-1-toddfreed%40meta.com
> Suggested-by: Jakub Kicinski <kuba@kernel.org>
> Suggested-by: Björn Töpel <bjorn@kernel.org>
> Fixes: 784abe24c903 ("net: Add decrypted field to skb")
> Signed-off-by: Todd Freed <toddfreed@meta.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111001831.3710881-1-toddfreed@meta.com?part=4