[PATCH nf-next 0/2] netfilter: don't send decrypted skbs in clear text

[Todd Freed <toddfreed@meta.com>]

skb->decrypted marks a packet which the device decrypted on receive, or
must encrypt on transmit (tls device offload, psp). since this series in
net, the ip stack doesn't fragment such packets, and sends no icmp error
about a received one. an error about a locally originated one is only
sent if it is routed to a local address.

  https://lore.kernel.org/netdev/20261111001831.3710881-1-toddfreed@meta.com

netfilter does both itself: the bridge refragments the packets which
bridge conntrack reassembled, and the reject code builds its own tcp
resets, and for the netdev and bridge families its own icmp errors. this
series applies the same rules there.

the psp socket-less associations series for net-next, which follows
this one, makes forwarding and bridging packets which a psp device
decrypted an intended use.

this series doesn't depend on the net series or the net-next series,
and doesn't conflict with them.

testing: on netdevsim psp, with the net series applied, nft reject of
psp socket traffic, with tcp reset and icmpx, for ipv4 and ipv6:

 - in an inet input chain and a netdev ingress chain, of the decrypted
   packets a host receives. without patch 2, the tcp resets and the
   netdev icmp errors are sent in the clear. with patch 2, they are not
   sent.
 - in an inet output chain, of the packets a host sends. with and
   without this series, tcp resets and icmp errors are sent to the local
   socket.

patch 1 is build-tested only

Todd Freed (2):
  netfilter: bridge: don't refragment decrypted skbs
  netfilter: reject: don't reply to decrypted skbs

 net/bridge/netfilter/nf_conntrack_bridge.c |  6 +++++
 net/ipv4/netfilter/nf_reject_ipv4.c        | 26 ++++++++++++++++++++
 net/ipv6/netfilter.c                       |  6 +++++
 net/ipv6/netfilter/nf_reject_ipv6.c        | 28 ++++++++++++++++++++++
 4 files changed, 66 insertions(+)


base-commit: 734bef548a96e8774d6eef5dfa2026c6edc4e80b
-- 
2.53.0-Meta