Re: [PATCH net-next v1 10/15] net/sched: flower: add psp_spi, psp_ver, and psp_dev matches

[sashiko-bot@kernel.org]

> Add a flow dissector key filled from the PSP Rx state (SKB_EXT_PSP) the
> device attached to a decrypted packet, and corresponding flower matches.
> SPI the packet was decrypted with (psp_spi, with a mask), PSP version
> (psp_ver), and the ID of the PSP device which decrypted it (psp_dev).
> 
> For example, to take the packets of one Rx association, (created with
> rx-spi-alloc), and remove their PSP state so that they can be forwarded,
> 
>   tc filter add dev eth0 ingress protocol ipv6 flower
>       psp_spi 0x80000001 psp_ver 0 psp_dev 1
>       action psp decap
> 
> Together these matches tie a rule to one association, in a form which
> hw can match on (offload comes in a follow-up series). The SPI is only
> unique on its PSP device, and an association has one PSP version. This
> matches the per-packet check that psp sockets have against its
> association, with one exception - the generation of the device key is
> not checked.
> 
> this means that a rule matching packets that correspond to an rx
> association which is stale (two rotations have passed), can still match.
> 
> It is therefore important that a rule which matches a SPI should be
> replaced before the device key has had two rotations. follow up work
> will bring enforcement of this based on key rotation events.
> 
> Note that this only ever matches packets which were decrypted, even if
> the mask is 0. So "psp_spi 0/0" matches any decrypted PSP packet.
> 
> Signed-off-by: Todd Freed <toddfreed@meta.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111005533.6436-1-toddfreed@meta.com?part=10