openvswitch: Scrub skb between namespaces
authorJoe Stringer <joestringer@nicira.com>
Fri, 16 Oct 2015 18:08:18 +0000 (11:08 -0700)
committerDavid S. Miller <davem@davemloft.net>
Mon, 19 Oct 2015 05:24:50 +0000 (22:24 -0700)
commit740dbc289155fdeed32438396370e70b684cd45e
treed57e072326e2c7867556f7f199a41e4b30b8b36f
parenta5d6f7dd300e7a3237410cc9d6d00427c18281c3
openvswitch: Scrub skb between namespaces

If OVS receives a packet from another namespace, then the packet should
be scrubbed. However, people have already begun to rely on the behaviour
that skb->mark is preserved across namespaces, so retain this one field.

This is mainly to address information leakage between namespaces when
using OVS internal ports, but by placing it in ovs_vport_receive() it is
more generally applicable, meaning it should not be overlooked if other
port types are allowed to be moved into namespaces in future.

Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/openvswitch/vport.c