Re: [PATCH net v5 2/8] psp: don't encapsulate ipv6 packets with extension headers

[sashiko-bot@kernel.org]

> psp_dev_encapsulate() inserts the udp+psp headers at the transport
> header, rewrites the protocol of the fixed ip header to udp, and writes
> tcp as the psp next header. so tcp must directly follow the fixed
> header.
> 
> if the packet is an ipv6 packet with extension headers, udp+psp is
> placed after them, but the next header indicating the l4 protocol is on
> the last extension header in the chain, not in the fixed header.
> therefore this produces a malformed packet.
> 
> in addition to being malformed, with mlx5 this kind of packet goes out
> unencrypted. since the tx association encodes intent to send encrypted
> packets, drop such packets instead.
> 
> a psp tcp socket emits such packets if certain socket options are set on
> it (e.g. IPV6_DSTOPTS). refusing the combination of such socket options
> with psp association would be helpful but is not implemented here. since
> extension headers can also come from a route the datapath check is
> needed anyway.
> 
> the check also covers ipv4: the l4 protocol must be tcp, and the
> transport header must follow the ip header and its options. packets of
> a psp tcp socket always pass it.
> 
> Fixes: fc724515741a ("psp: provide encapsulation helper for drivers")
> Signed-off-by: Todd Freed <toddfreed@meta.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111001831.3710881-1-toddfreed@meta.com?part=2