From 81f98fff75ae54bbe7637f46accf966c81c82cf1 Mon Sep 17 00:00:00 2001 From: Idan Freiberg Date: Wed, 15 Jul 2026 23:52:48 +0300 Subject: [PATCH] MT#55283 kernel-module: scrub forwarded skb metadata Closes #2140 Change-Id: I89c8a75d79c1c16ece6ca98ae2bbd5f615cc3ca2 (cherry picked from commit 7051631097d57bd0e4c50f4c64d11afc9d4f7542) --- kernel-module/nft_rtpengine.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel-module/nft_rtpengine.c b/kernel-module/nft_rtpengine.c index 6ad67df64..e273e59aa 100644 --- a/kernel-module/nft_rtpengine.c +++ b/kernel-module/nft_rtpengine.c @@ -5571,6 +5571,11 @@ static int send_proxy_packet(struct sk_buff *skb, const struct re_address *src, goto drop; } + /* This skb was received from the network but is now being reinjected as + * a new locally generated packet. Drop inherited routing, conntrack, and + * netfilter metadata before handing it to the IP output path. */ + skb_scrub_packet(skb, true); + switch (src->family) { case AF_INET: return send_proxy_packet4(skb, src, dst, tos, net);