Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit da786717 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: ip6t_rpfilter: set F_IFACE for linklocal addresses 



Roman reports that DHCPv6 client no longer sees replies from server
due to

ip6tables -t raw -A PREROUTING -m rpfilter --invert -j DROP

rule.  We need to set the F_IFACE flag for linklocal addresses, they
are scoped per-device.

Fixes: 47b7e7f8 ("netfilter: don't set F_IFACE on ipv6 fib lookups")
Reported-by: default avatarRoman Mamedov <rm@romanrm.net>
Tested-by: default avatarRoman Mamedov <rm@romanrm.net>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b71ed54d

net/ipv6/netfilter/ip6t_rpfilter.c

+11 −1
Original line number Diff line number Diff line
@@ -26,6 +26,12 @@ static bool rpfilter_addr_unicast(const struct in6_addr *addr) 
	return addr_type & IPV6_ADDR_UNICAST;

}



static bool rpfilter_addr_linklocal(const struct in6_addr *addr)

{

	int addr_type = ipv6_addr_type(addr);

	return addr_type & IPV6_ADDR_LINKLOCAL;

}



static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,

				     const struct net_device *dev, u8 flags)

{
@@ -48,7 +54,11 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, 
	}



	fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;

	if ((flags & XT_RPFILTER_LOOSE) == 0)



	if (rpfilter_addr_linklocal(&iph->saddr)) {

		lookup_flags |= RT6_LOOKUP_F_IFACE;

		fl6.flowi6_oif = dev->ifindex;

	} else if ((flags & XT_RPFILTER_LOOSE) == 0)

		fl6.flowi6_oif = dev->ifindex;



	rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags);