[PATCH 0/1] [focal:linux, hirsute:linux, impish:linux] ebpf: fix mark management wrt bpf_redirect

[Tim Gardner]

BugLink: https://bugs.launchpad.net/bugs/1935040

[Impact]

The ebpf function 'bpf_redirect' reset the mark when used with the flag BPF_F_INGRESS.
There are two main problems with that:
 - it's not consistent between legacy tunnels and ebpf;
 - it's not consistent between ingress and egress.

In fact, the eBPF program can easily reset the mark, but it cannot preserve it.

This kind of patch was already done in the past, see commit 963a88b31ddb
("tunnels: harmonize cleanup done on skb on xmit path"), commit ea23192e8e57
("tunnels: harmonize cleanup done on skb on rx path") and commit
213dd74aee76 ("skbuff: Do not scrub skb mark within the same name space").

[Fix]

This is fixed upstream with commit ff70202b2d1a ("dev_forward_skb: do not scrub
skb mark within the same name space").

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ff70202b2d1a


[Test Case]

Mark a packet in the POSTROUTING hook, redirect it to another interface and
display it with a netfilter log rule to check the mark.

[Where problems could occur]

A user could expect that the mark is reset after a call to bpf_redirect(BPF_F_INGRESS),
but he could easily reset it in the eBPF program himself.


[Other Info]