IPIP tunneling support does not result in crossing a netns, therefore,
adopt the more conservative variant of skb_scrub_packet() by specifying
!xnet, keep the existing skb mark in place.
Fixes: d30301ba4b07 ("netfilter: flowtable: Add IPIP tx sw acceleration")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
@Lorenzo: Do you remember the reason why this is scrubbing as crossing netns?
There is a LLM report that is flagging this as an issue when interacting with
other subsystem, eg. packets was marked. At least in the tunnel driver I can
see this is conditional.
net/netfilter/nf_flow_table_ip.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index 19cafae748ab..78bba416dd5b 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -630,7 +630,7 @@ static int nf_flow_tunnel_ip_push(struct net *net, struct sk_buff *skb,
if (err)
return err;
- skb_scrub_packet(skb, true);
+ skb_scrub_packet(skb, false);
skb_clear_hash_if_not_l4(skb);
/* Push down and install the IP header. */
@@ -699,7 +699,7 @@ static int nf_flow_tunnel_ip6_push(struct net *net, struct sk_buff *skb,
if (err)
return err;
- skb_scrub_packet(skb, true);
+ skb_scrub_packet(skb, false);
mtu = dst_mtu(dst) - sizeof(*ip6h);
mtu = max(mtu, IPV6_MIN_MTU);
skb_dst_update_pmtu_no_confirm(skb, mtu);
--
2.47.3