[PATCH net 0/3] net: don't redirect decrypted skbs to ingress, psp time-wait validator

[Todd Freed <toddfreed@meta.com>]

Three fixes that are relevant for the net-next series, "psp: introduce
socket-less associations". These were previously patches 6-8 of its v1:

  https://lore.kernel.org/netdev/20261111005533.6436-1-toddfreed@meta.com

The first two patches prevent sending decrypted skbs from egress to
ingress, since the meaning of skb->decrypted depends on the direction.
This affects the packets of kTLS and PSP device offload sockets.

The third patch makes psp_twsk_init() give a validator only to the
time-wait sockets of PSP connections with a Tx key, instead of to every
TCP time-wait socket. It has no effect today, but the net-next series
will rely on the presence of the validator to check if the socket has
an encryption offload.

Testing, on two hosts with mlx5 (ConnectX-7), with and without the
patches: an egress rule on a connection's flow sends its packets to the
device's ingress, with mirred (mirror and redirect) or bpf
(bpf_clone_redirect() and bpf_redirect() with BPF_F_INGRESS), for a PSP
device offload socket, a kTLS device offload socket and a plain TCP
socket.

Without the patches, the PSP and kTLS sockets' packets arrive on ingress
in all four cases. With them, none do: mirrored and cloned packets still
go out, encrypted by the device, and redirected ones are dropped. The
plain TCP socket's packets arrive on ingress in all four cases, with and
without the patches. The PSP and plain TCP cases give the same results
on netdevsim.

drivers/net psp.py and hw/tls_hw_offload.py pass, with and without the
patches, as does tc-testing mirred.json on netdevsim (39 pass, 7 skipped
by their dependsOn probes). Each patch builds without warnings (gcc and
clang, allmodconfig, W=1).

Todd Freed (3):
  net/sched: act_mirred: don't send decrypted skbs from egress to
    ingress
  bpf: don't redirect decrypted skbs from egress to ingress
  psp: only give time-wait sockets of PSP connections a validator

 net/core/filter.c      | 10 ++++++++++
 net/psp/psp_sock.c     |  7 +++++--
 net/sched/act_mirred.c |  6 ++++++
 3 files changed, 21 insertions(+), 2 deletions(-)


base-commit: ead6fa9a0ab194f02a2f36d634b193e9c5f9a1c6
-- 
2.53.1-Meta