[Devel] [PATCH RH8 2/2] ve/venet: drop skb marks on VE boundary

[Pavel Tikhomirov]

Before this patch one can create venet based vz8 container and setup:

On host:

iptables -A OUTPUT -j MARK --set-mark 33

In CT:

iptables -A INPUT -m mark --mark 33 -j DROP

This would leed all incomming traffic to container to be dropped in
container (same in opposite direction). That is wrong... All packets
that are sent to or received from container should not have any marks
similar to what happens with packets to/from the real node.

This is an only hunk from: ("vznetstat: Move the code to drop redundant
skb marks to *_xmit() functions #PSBM-122082") which is still relevant,
but let's make it work in both directions.

https://jira.sw.ru/browse/PSBM-127785
(cherry-picked from commit 0de95a0dad7179f73d3877350e32c7a8ff3d2a44)

Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
---
 drivers/net/venetdev.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/net/venetdev.c b/drivers/net/venetdev.c
index cdf56b9e7ec13..2849f84545bf1 100644
--- a/drivers/net/venetdev.c
+++ b/drivers/net/venetdev.c
@@ -509,6 +509,23 @@ static int venet_xmit(struct sk_buff *skb, struct net_device *dev)
 	skb_reset_mac_header(skb);
 	memset(skb->data - dev->hard_header_len, 0, dev->hard_header_len);
 
+	/*
+	 * Vzctl configures tc on Host for shaping based on skb->marks
+	 * which are set by nft "ingress" rules in host netns. We don't
+	 * want container user see those vz-specific marks.
+	 *
+	 * On the other hand someone might also set own marks inside a
+	 * Container, thus we don't want those user marks to conflict with
+	 * our traffic shaping on host.
+	 *
+	 * Same applies to intercontainer communication.
+	 *
+	 * => if the packet goes between different VEs we must drop all
+	 * skb marks.
+	 */
+	if (ve != dev_net(dev)->owner_ve)
+		skb->mark = 0;
+
 	nf_reset(skb);
 	length = skb->len;
 
-- 
2.30.2