Re: [PATCH nf-next] netfilter: flowtable: do not scrub as crossing netns

[Lorenzo Bianconi <lorenzo@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 1802 bytes --]

> IPIP tunneling support does not result in crossing a netns, therefore,
> adopt the more conservative variant of skb_scrub_packet() by specifying
> !xnet, keep the existing skb mark in place.
> 
> Fixes: d30301ba4b07 ("netfilter: flowtable: Add IPIP tx sw acceleration")

I guess we should add: Fixes: 93cf357fa797 ("netfilter: flowtable: Add IP6IP6 tx sw acceleration")

> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>

> ---
> @Lorenzo: Do you remember the reason why this is scrubbing as crossing netns?
> There is a LLM report that is flagging this as an issue when interacting with
> other subsystem, eg. packets was marked. At least in the tunnel driver I can
> see this is conditional.

I guess it is a leftover from original implementation

Regards,
Lorenzo

> 
>  net/netfilter/nf_flow_table_ip.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
> index 19cafae748ab..78bba416dd5b 100644
> --- a/net/netfilter/nf_flow_table_ip.c
> +++ b/net/netfilter/nf_flow_table_ip.c
> @@ -630,7 +630,7 @@ static int nf_flow_tunnel_ip_push(struct net *net, struct sk_buff *skb,
>  	if (err)
>  		return err;
>  
> -	skb_scrub_packet(skb, true);
> +	skb_scrub_packet(skb, false);
>  	skb_clear_hash_if_not_l4(skb);
>  
>  	/* Push down and install the IP header. */
> @@ -699,7 +699,7 @@ static int nf_flow_tunnel_ip6_push(struct net *net, struct sk_buff *skb,
>  	if (err)
>  		return err;
>  
> -	skb_scrub_packet(skb, true);
> +	skb_scrub_packet(skb, false);
>  	mtu = dst_mtu(dst) - sizeof(*ip6h);
>  	mtu = max(mtu, IPV6_MIN_MTU);
>  	skb_dst_update_pmtu_no_confirm(skb, mtu);
> -- 
> 2.47.3
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]