summaryrefslogtreecommitdiff
path: root/net/core
diff options
context:
space:
mode:
authorThomas Graf <tgraf@suug.ch>2014-12-23 01:13:18 +0100
committerDavid S. Miller <davem@davemloft.net>2014-12-24 00:21:43 -0500
commitb8fb4e0648a2ab3734140342002f68fb0c7d1602 (patch)
tree59890b2e2210f2310dedb9d825a5b8e3e6795c67 /net/core
parent796f2da81bead71ffc91ef70912cd8d1827bf756 (diff)
net: Reset secmark when scrubbing packet
skb_scrub_packet() is called when a packet switches between a context such as between underlay and overlay, between namespaces, or between L3 subnets. While we already scrub the packet mark, connection tracking entry, and cached destination, the security mark/context is left intact. It seems wrong to inherit the security context of a packet when going from overlay to underlay or across forwarding paths. Signed-off-by: Thomas Graf <tgraf@suug.ch> Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
-rw-r--r--net/core/skbuff.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index ae13ef6b3ea7..395c15b82087 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4148,6 +4148,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
skb->ignore_df = 0;
skb_dst_drop(skb);
skb->mark = 0;
+ skb_init_secmark(skb);
secpath_reset(skb);
nf_reset(skb);
nf_reset_trace(skb);