Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 621e84d6 authored by Nicolas Dichtel's avatar Nicolas Dichtel Committed by David S. Miller
Browse files

dev: introduce skb_scrub_packet() 



The goal of this new function is to perform all needed cleanup before sending
an skb into another netns.

Signed-off-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 38ae92dc

include/linux/skbuff.h

+1 −0
Original line number Diff line number Diff line
@@ -2384,6 +2384,7 @@ extern void skb_split(struct sk_buff *skb, 
				 struct sk_buff *skb1, const u32 len);

extern int	       skb_shift(struct sk_buff *tgt, struct sk_buff *skb,

				 int shiftlen);

extern void	       skb_scrub_packet(struct sk_buff *skb);



extern struct sk_buff *skb_segment(struct sk_buff *skb,

				   netdev_features_t features);

net/core/dev.c

+1 −10
Original line number Diff line number Diff line
@@ -1652,22 +1652,13 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb) 
		}

	}



	skb_orphan(skb);



	if (unlikely(!is_skb_forwardable(dev, skb))) {

		atomic_long_inc(&dev->rx_dropped);

		kfree_skb(skb);

		return NET_RX_DROP;

	}

	skb->skb_iif = 0;

	skb_dst_drop(skb);

	skb->tstamp.tv64 = 0;

	skb->pkt_type = PACKET_HOST;

	skb_scrub_packet(skb);

	skb->protocol = eth_type_trans(skb, dev);

	skb->mark = 0;

	secpath_reset(skb);

	nf_reset(skb);

	nf_reset_trace(skb);

	return netif_rx(skb);

}

EXPORT_SYMBOL_GPL(dev_forward_skb);

net/core/skbuff.c

+23 −0
Original line number Diff line number Diff line
@@ -3492,3 +3492,26 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, 
	return true;

}

EXPORT_SYMBOL(skb_try_coalesce);



/**

 * skb_scrub_packet - scrub an skb before sending it to another netns

 *

 * @skb: buffer to clean

 *

 * skb_scrub_packet can be used to clean an skb before injecting it in

 * another namespace. We have to clear all information in the skb that

 * could impact namespace isolation.

 */

void skb_scrub_packet(struct sk_buff *skb)

{

	skb_orphan(skb);

	skb->tstamp.tv64 = 0;

	skb->pkt_type = PACKET_HOST;

	skb->skb_iif = 0;

	skb_dst_drop(skb);

	skb->mark = 0;

	secpath_reset(skb);

	nf_reset(skb);

	nf_reset_trace(skb);

}

EXPORT_SYMBOL_GPL(skb_scrub_packet);