From 31f89e512d657271f33365313c43cf571b16bdd2 Mon Sep 17 00:00:00 2001 From: Idan Freiberg Date: Wed, 15 Jul 2026 23:52:48 +0300 Subject: [PATCH] MT#55283 kernel-module: scrub forwarded skb metadata Closes #2140 Change-Id: I89c8a75d79c1c16ece6ca98ae2bbd5f615cc3ca2 (cherry picked from commit 7051631097d57bd0e4c50f4c64d11afc9d4f7542) (cherry picked from commit 53696a907cabbc4dc7a4f55260de8298c1d75618) --- kernel-module/xt_RTPENGINE.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel-module/xt_RTPENGINE.c b/kernel-module/xt_RTPENGINE.c index 6a25b0583..f603956f5 100644 --- a/kernel-module/xt_RTPENGINE.c +++ b/kernel-module/xt_RTPENGINE.c @@ -5122,6 +5122,11 @@ static int send_proxy_packet(struct sk_buff *skb, struct re_address *src, struct goto drop; } + /* This skb was received from the network but is now being reinjected as + * a new locally generated packet. Drop inherited routing, conntrack, and + * netfilter metadata before handing it to the IP output path. */ + skb_scrub_packet(skb, true); + switch (src->family) { case AF_INET: return send_proxy_packet4(skb, src, dst, tos, par);