Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 740dbc28 authored by Joe Stringer's avatar Joe Stringer Committed by David S. Miller
Browse files

openvswitch: Scrub skb between namespaces 



If OVS receives a packet from another namespace, then the packet should
be scrubbed. However, people have already begun to rely on the behaviour
that skb->mark is preserved across namespaces, so retain this one field.

This is mainly to address information leakage between namespaces when
using OVS internal ports, but by placing it in ovs_vport_receive() it is
more generally applicable, meaning it should not be overlooked if other
port types are allowed to be moved into namespaces in future.

Signed-off-by: default avatarJoe Stringer <joestringer@nicira.com>
Acked-by: default avatarPravin B Shelar <pshelar@nicira.com>
Acked-by: default avatarThomas Graf <tgraf@suug.ch>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a5d6f7dd

net/openvswitch/vport.c

+9 −0
Original line number Diff line number Diff line
@@ -444,6 +444,15 @@ int ovs_vport_receive(struct vport *vport, struct sk_buff *skb, 


	OVS_CB(skb)->input_vport = vport;

	OVS_CB(skb)->mru = 0;

	if (unlikely(dev_net(skb->dev) != ovs_dp_get_net(vport->dp))) {

		u32 mark;



		mark = skb->mark;

		skb_scrub_packet(skb, true);

		skb->mark = mark;

		tun_info = NULL;

	}



	/* Extract flow from 'skb' into 'key'. */

	error = ovs_flow_key_extract(tun_info, skb, &key);

	if (unlikely(error)) {