Re: [PATCH net v5 5/8] ipv6: icmpv6: don't quote decrypted payload in icmpv6 errors

[sashiko-bot@kernel.org]

> an icmpv6 error quotes as much of the invoking packet as fits in the
> minimum ipv6 mtu. if the device had decrypted the packet (as indicated
> by skb->decrypted) then the icmpv6 error is sending part of it back out
> onto the network in cleartext.
> 
> as in the previous patch for icmp: ktls rx device offload and psp can't
> be told apart reliably, and psp also encrypts the l4 header, so don't
> send an error about a received decrypted skb at all. linux receivers
> would drop an error whose quote stops before the l4 header anyway
> (icmpv6_notify()).
> 
> on tx, skb->decrypted is also set. an error about a locally originated
> skb (skb_iif is 0) is sent in full as before, if its route goes to a
> local address (RTF_LOCAL), like RTCF_LOCAL in the previous patch.
> 
> an error about a received decrypted skb is dropped before the rate
> limit, so that it doesn't use up the peer's and the global icmpv6
> credit.
> 
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261023234640.1459291-1-toddfreed%40meta.com
> Suggested-by: Jakub Kicinski <kuba@kernel.org>
> Suggested-by: Björn Töpel <bjorn@kernel.org>
> Fixes: 784abe24c903 ("net: Add decrypted field to skb")
> Signed-off-by: Todd Freed <toddfreed@meta.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111001831.3710881-1-toddfreed@meta.com?part=5