[Devel] [PATCH RH8 1/2] ve/veth: drop skb marks on VE boundary

[Pavel Tikhomirov]

Before this patch one can create veth based vz8 container and setup:

On host:

iptables -A OUTPUT -j MARK --set-mark 33

In CT:

iptables -A INPUT -m mark --mark 33 -j DROP

This would leed all incomming traffic to container to be dropped in
container (same in opposite direction).  That is wrong... All packets
that are sent to or received from container should not have any marks
similar to what happens with packets to/from the real node.

Now when we drop vznetstat in vz8 we can safely revert this hack:

Revert "ve/veth: don't drop skb->mark if NETIF_F_VENET is set"
This reverts commit 34a3e6097c97872df787de4ab6f9cbb9580e6625.

https://jira.sw.ru/browse/PSBM-127785
Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
---
 net/core/skbuff.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index cedc3dc9f1c60..5cb45c9226fda 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5055,9 +5055,8 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
 		return;
 
 	ipvs_reset(skb);
+	skb->mark = 0;
 	skb->tstamp = 0;
-	if (!(skb->dev->features & NETIF_F_VENET))
-		skb->mark = 0;
 }
 EXPORT_SYMBOL_GPL(skb_scrub_packet);
 
-- 
2.30.2