[PATCH net-next v17 09/15] net: skbuff: add skb->decrypt_failed bit

[Rishikesh Jethwani <rjethwani@purestorage.com>]

Add skb->decrypt_failed, set when hardware could not authenticate an
skb's TLS payload. The payload may have been transformed (XORed) or
left as wire ciphertext, so software must re-authenticate the record
and undo the transform on any XORed fragment before it can be
decrypted. Propagate it in skb_copy_decrypted() alongside
skb->decrypted. Guarded by CONFIG_SKB_DECRYPTED like skb->decrypted.

This is a prerequisite for TLS 1.3 device-offload RX KeyUpdate support,
where the NIC flags records it could not authenticate across a key
change.

Signed-off-by: Rishikesh Jethwani <rjethwani@purestorage.com>
---
 include/linux/skbuff.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 421f6fc45451..5da2c1149d98 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -851,6 +851,10 @@ enum skb_tstamp_type {
  *		unreadable.
  *	@dst_pending_confirm: need to confirm neighbour
  *	@decrypted: Decrypted SKB
+ *	@decrypt_failed: hardware could not authenticate this skb's TLS payload.
+ *		The payload may have been transformed (XORed) or left as wire
+ *		ciphertext, so software must re-authenticate the record and undo the
+ *		transform on any XORed fragment before it can be decrypted
  *	@slow_gro: state present at GRO time, slower prepare step required
  *	@tstamp_type: When set, skb->tstamp has the
  *		delivery_time clock base of skb->tstamp.
@@ -1025,6 +1029,7 @@ struct sk_buff {
 #endif
 #ifdef CONFIG_SKB_DECRYPTED
 	__u8			decrypted:1;
+	__u8			decrypt_failed:1;
 #endif
 	__u8			slow_gro:1;
 #if IS_ENABLED(CONFIG_IP_SCTP)
@@ -1716,6 +1721,7 @@ static inline void skb_copy_decrypted(struct sk_buff *to,
 {
 #ifdef CONFIG_SKB_DECRYPTED
 	to->decrypted = from->decrypted;
+	to->decrypt_failed = from->decrypt_failed;
 #endif
 }
 
-- 
2.50.1