[PATCH net-next v1 00/15] psp: introduce socket-less associations

[Todd Freed <toddfreed@meta.com>]

psp associations today are bound to a tcp socket when created. traffic
on that socket is encapsulated in transport-mode psp, and encrypted.

this series adds associations which aren't bound to a socket, which
allows psp encapsulation and encryption to be applied to forwarded
traffic. you can use this to transparently apply psp tunnels to flows,
with help from userspace to manage the tc rules and orchestrate key
exchange.

the lifecycle of socket-less associations is managed over the psp
netlink family. socket-less associations are stored in a small registry,
and are addressable by id. the registry does not contain socket
associations.

socket-less associations are on the device's association lists, like
socket associations. rx ones are therefore marked stale by key rotation
in the same way. in this series, nothing acts on socket-less rx
associations on key rotation. instead, userspace should replace decap
rules for a SPI before its device key has been rotated twice. a
follow-up will bring enforcement.

series structure,

1, 2/ prepares psp to work with non-tcp packets

3, 4/ adds the netlink commands for managing socket-less associations

5/ adds a METADATA_PSP dst which carries the socket-less psp association
on an skb for tx, and the transmit checks for it

6, 7/ keep mirred and bpf from sending decrypted skbs from egress to
ingress, since skb->decrypted depends on direction

8/ limit time-wait psp socket validator to sockets actually in
time-wait. the new psp actions check for presence of the validator

9/ adds the act_psp tc actions, psp encap and psp decap. in software,
encap is egress only. 

10/ adds flower matches on psp header fields, for rx matching

11, 12/ add drv-net tests (netdevsim and hardware)

13/ makes tc-testing run dependsOn probes outside the test namespace,
where they currently always fail

14/ adds tc-testing tests

15/ Documentation for socket-less psp associations

a following series adds hardware offload of the psp actions and flower
matches, psp tunnel mode (which is offload only and therefore not
included here), encap on ingress (also offload only), and the mlx5
implementation for switchdev mode. It's available in the tree below.

relation to the psp fixes in net:

this series is based on net-next, and overlaps with "psp, tls: don't
send offloaded contents in cleartext" in net:

 https://lore.kernel.org/netdev/20261111001831.3710881-1-toddfreed@meta.com

when net is merged into net-next:

 - net/psp/psp_main.c conflicts around psp_dev_encap_ok(), which both
   add: net's only allows tcp, this series' (patch 2) takes any l4
   protocol. keep this series' version of the function, and its
   comments above it and above psp_dev_encapsulate().
 - tools/testing/selftests/drivers/net/psp.py and
   tools/testing/selftests/drivers/net/config conflict: keep both sides
   (imports, constants, the list of test cases; the NET_ACT_* options).

relation to the netfilter fixes in nf-next:

packets which a psp device decrypted don't have to end in a local psp
socket. they can already be forwarded or bridged today, but with
socket-less associations that is the intended use, e.g. a router that
decaps and forwards. netfilter handles two cases itself, outside the ip
stack paths which the net series fixes, and would send such a packet's
decrypted contents in clear text:

 - the bridge refragments packets which bridge conntrack reassembled
   (br_ip6_fragment(), nf_br_ip_fragment()), without the check of "net:
   don't fragment decrypted skbs".
 - the reject code builds its own icmp errors and tcp resets
   (nf_reject_skb_v4_unreach() and friends), without icmp_send() and
   icmpv6_send(), which the net series' icmp patches cover.

a separate series to nf-next applies the net series' rules to both:

  "netfilter: bridge: don't refragment decrypted skbs"
  "netfilter: reject: don't reply to decrypted skbs"

  https://lore.kernel.org/netfilter-devel/20261111003111.3826942-1-toddfreed@meta.com

it doesn't depend on this series, and the two don't conflict.

trees:

the full tree, with the net fixes, the nf-next series, this series and
the mlx5 offload series, and the conflicts above resolved, is at:

 https://github.com/toddfreed/psptc branch psptc

iproute2 tree, with support for the psp action and the psp flower
matches, based on iproute2-next. the selftests need it:

 https://github.com/toddfreed/iproute2-psptc branch tc-psp

testing:

 - netdevsim: drivers/net psp.py passes (57 tests), and tc-testing
   psp.json (17 tests).
 - mlx5 (ConnectX-7, FW 28.48), two hosts: drivers/net psp.py passes:
   46 pass, 8 skip (GMAC versions not supported by the device),
   3 xfail (netdevsim only).
 - each patch builds without warnings with gcc and clang, allmodconfig,
   W=1.
Todd Freed (15):
  psp: get netns from net_device instead of sock
  psp: take the psp nexthdr from the packet on encap
  psp: declare psp_assoc_set_tx() in psp.h
  psp: add support for socket-less psp associations
  net: add METADATA_PSP dst to carry a psp association on an skb
  net/sched: act_mirred: don't send decrypted skbs from egress to
    ingress
  bpf: don't redirect decrypted skbs from egress to ingress
  psp: only give time-wait sockets of psp connections a validator
  net/sched: add act_psp for psp transport mode
  net/sched: flower: add psp_spi, psp_ver, and psp_dev matches
  selftests: drv-net: psp: test socket-less associations and the tc psp
    action
  selftests: drv-net: psp: test that software encap on ingress drops
  selftests: tc-testing: run dependsOn probes outside the test namespace
  selftests: tc-testing: add tests for the psp action
  Documentation: networking: psp: document socket-less associations

 Documentation/netlink/specs/psp.yaml          |  98 ++-
 Documentation/netlink/specs/tc.yaml           |  14 +
 Documentation/networking/psp.rst              | 139 +++-
 MAINTAINERS                                   |   3 +
 .../mellanox/mlx5/core/en_accel/psp_rxtx.c    |   2 +-
 .../net/ethernet/mellanox/mlx5/core/en_main.c |  33 +
 drivers/net/netdevsim/psp.c                   |   2 +-
 include/linux/skbuff.h                        |   4 +
 include/net/dst_metadata.h                    |  19 +
 include/net/flow_dissector.h                  |  18 +
 include/net/psp/functions.h                   |  91 ++-
 include/net/psp/types.h                       |   1 +
 include/net/tc_act/tc_psp.h                   |  23 +
 include/uapi/linux/pkt_cls.h                  |   6 +
 include/uapi/linux/psp.h                      |   6 +
 include/uapi/linux/tc_act/tc_psp.h            |  28 +
 net/core/dev.c                                |  48 +-
 net/core/dst.c                                |   5 +
 net/core/filter.c                             |   9 +
 net/core/flow_dissector.c                     |  27 +
 net/psp/Makefile                              |   2 +-
 net/psp/psp-nl-gen.c                          |  60 ++
 net/psp/psp-nl-gen.h                          |   8 +
 net/psp/psp.h                                 |   7 +
 net/psp/psp_assoc.c                           | 120 +++
 net/psp/psp_main.c                            |  54 +-
 net/psp/psp_nl.c                              | 261 ++++++
 net/psp/psp_sock.c                            |  32 +-
 net/sched/Kconfig                             |  13 +
 net/sched/Makefile                            |   1 +
 net/sched/act_mirred.c                        |   6 +
 net/sched/act_psp.c                           | 439 ++++++++++
 net/sched/cls_flower.c                        |  64 ++
 tools/testing/selftests/drivers/net/config    |   5 +
 tools/testing/selftests/drivers/net/psp.py    | 750 +++++++++++++++++-
 tools/testing/selftests/tc-testing/config     |   2 +
 .../tc-testing/tc-tests/actions/psp.json      | 459 +++++++++++
 tools/testing/selftests/tc-testing/tdc.py     |   2 +-
 tools/testing/selftests/tc-testing/tdc.sh     |   1 +
 39 files changed, 2812 insertions(+), 50 deletions(-)
 create mode 100644 include/net/tc_act/tc_psp.h
 create mode 100644 include/uapi/linux/tc_act/tc_psp.h
 create mode 100644 net/psp/psp_assoc.c
 create mode 100644 net/sched/act_psp.c
 create mode 100644 tools/testing/selftests/tc-testing/tc-tests/actions/psp.json


base-commit: ed04b202027249e2769420893220f54a56e0c59a
-- 
2.53.0-Meta