Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 47b7e7f8 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: don't set F_IFACE on ipv6 fib lookups 

"fib" starts to behave strangely when an ipv6 default route is
added - the FIB lookup returns a route using 'oif' in this case.

This behaviour was inherited from ip6tables rpfilter so change
this as well.

Bugzilla: https://bugzilla.netfilter.org/show_bug.cgi?id=1221


Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 2412d897

net/ipv6/netfilter/ip6t_rpfilter.c

+0 −4
Original line number Diff line number Diff line
@@ -48,10 +48,6 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, 
	}



	fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;

	if ((flags & XT_RPFILTER_LOOSE) == 0) {

		fl6.flowi6_oif = dev->ifindex;

		lookup_flags |= RT6_LOOKUP_F_IFACE;

	}



	rt = (void *) ip6_route_lookup(net, &fl6, lookup_flags);

	if (rt->dst.error)

net/ipv6/netfilter/nft_fib_ipv6.c

+2 −10
Original line number Diff line number Diff line
@@ -180,7 +180,6 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, 
	}



	*dest = 0;

 again:

	rt = (void *)ip6_route_lookup(nft_net(pkt), &fl6, lookup_flags);

	if (rt->dst.error)

		goto put_rt_err;
@@ -189,15 +188,8 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, 
	if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL))

		goto put_rt_err;



	if (oif && oif != rt->rt6i_idev->dev) {

		/* multipath route? Try again with F_IFACE */

		if ((lookup_flags & RT6_LOOKUP_F_IFACE) == 0) {

			lookup_flags |= RT6_LOOKUP_F_IFACE;

			fl6.flowi6_oif = oif->ifindex;

			ip6_rt_put(rt);

			goto again;

		}

	}

	if (oif && oif != rt->rt6i_idev->dev)

		goto put_rt_err;



	switch (priv->result) {

	case NFT_FIB_RESULT_OIF: