* [PATCH net] net: Reset secmark when scrubbing packet
@ 2014-12-23 0:13 Thomas Graf
2014-12-23 19:28 ` Flavio Leitner
2014-12-24 5:22 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Thomas Graf @ 2014-12-23 0:13 UTC (permalink / raw)
To: davem; +Cc: netdev
skb_scrub_packet() is called when a packet switches between a context
such as between underlay and overlay, between namespaces, or between
L3 subnets.
While we already scrub the packet mark, connection tracking entry,
and cached destination, the security mark/context is left intact.
It seems wrong to inherit the security context of a packet when going
from overlay to underlay or across forwarding paths.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
---
net/core/skbuff.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index ae13ef6..395c15b 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4148,6 +4148,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
skb->ignore_df = 0;
skb_dst_drop(skb);
skb->mark = 0;
+ skb_init_secmark(skb);
secpath_reset(skb);
nf_reset(skb);
nf_reset_trace(skb);
--
1.9.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] net: Reset secmark when scrubbing packet
2014-12-23 0:13 [PATCH net] net: Reset secmark when scrubbing packet Thomas Graf
@ 2014-12-23 19:28 ` Flavio Leitner
2014-12-24 5:22 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Flavio Leitner @ 2014-12-23 19:28 UTC (permalink / raw)
To: Thomas Graf; +Cc: davem, netdev
On Tuesday, December 23, 2014 01:13:18 AM Thomas Graf wrote:
>
> skb_scrub_packet() is called when a packet switches between a context
> such as between underlay and overlay, between namespaces, or between
> L3 subnets.
>
> While we already scrub the packet mark, connection tracking entry,
> and cached destination, the security mark/context is left intact.
>
> It seems wrong to inherit the security context of a packet when going
> from overlay to underlay or across forwarding paths.
>
> Signed-off-by: Thomas Graf <tgraf@suug.ch>
> ---
> net/core/skbuff.c | 1 +
> 1 file changed, 1 insertion(+)
Acked-by: Flavio Leitner <fbl@sysclose.org>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] net: Reset secmark when scrubbing packet
2014-12-23 0:13 [PATCH net] net: Reset secmark when scrubbing packet Thomas Graf
2014-12-23 19:28 ` Flavio Leitner
@ 2014-12-24 5:22 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2014-12-24 5:22 UTC (permalink / raw)
To: tgraf; +Cc: netdev
From: Thomas Graf <tgraf@suug.ch>
Date: Tue, 23 Dec 2014 01:13:18 +0100
> skb_scrub_packet() is called when a packet switches between a context
> such as between underlay and overlay, between namespaces, or between
> L3 subnets.
>
> While we already scrub the packet mark, connection tracking entry,
> and cached destination, the security mark/context is left intact.
>
> It seems wrong to inherit the security context of a packet when going
> from overlay to underlay or across forwarding paths.
>
> Signed-off-by: Thomas Graf <tgraf@suug.ch>
Applied and queued up for -stable, thanks Thomas.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-12-24 5:22 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-12-23 0:13 [PATCH net] net: Reset secmark when scrubbing packet Thomas Graf
2014-12-23 19:28 ` Flavio Leitner
2014-12-24 5:22 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).