summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorJoe Stringer <joestringer@nicira.com>2015-10-16 11:08:18 -0700
committerDavid S. Miller <davem@davemloft.net>2015-10-18 22:24:50 -0700
commit740dbc289155fdeed32438396370e70b684cd45e (patch)
treed57e072326e2c7867556f7f199a41e4b30b8b36f /net
parenta5d6f7dd300e7a3237410cc9d6d00427c18281c3 (diff)
downloadlinux-740dbc289155fdeed32438396370e70b684cd45e.tar.bz2
openvswitch: Scrub skb between namespaces
If OVS receives a packet from another namespace, then the packet should be scrubbed. However, people have already begun to rely on the behaviour that skb->mark is preserved across namespaces, so retain this one field. This is mainly to address information leakage between namespaces when using OVS internal ports, but by placing it in ovs_vport_receive() it is more generally applicable, meaning it should not be overlooked if other port types are allowed to be moved into namespaces in future. Signed-off-by: Joe Stringer <joestringer@nicira.com> Acked-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/openvswitch/vport.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index fc5c0b9ccfe9..12a36ac21eda 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -444,6 +444,15 @@ int ovs_vport_receive(struct vport *vport, struct sk_buff *skb,
OVS_CB(skb)->input_vport = vport;
OVS_CB(skb)->mru = 0;
+ if (unlikely(dev_net(skb->dev) != ovs_dp_get_net(vport->dp))) {
+ u32 mark;
+
+ mark = skb->mark;
+ skb_scrub_packet(skb, true);
+ skb->mark = mark;
+ tun_info = NULL;
+ }
+
/* Extract flow from 'skb' into 'key'. */
error = ovs_flow_key_extract(tun_info, skb, &key);
if (unlikely(error)) {