lkml.org 
[lkml]   [2018]   [Sep]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.18 069/197] netfilter: ip6t_rpfilter: set F_IFACE for linklocal addresses
    Date
    4.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Florian Westphal <fw@strlen.de>

    [ Upstream commit da786717e0894886301ed2536843c13f9e8fd53e ]

    Roman reports that DHCPv6 client no longer sees replies from server
    due to

    ip6tables -t raw -A PREROUTING -m rpfilter --invert -j DROP

    rule. We need to set the F_IFACE flag for linklocal addresses, they
    are scoped per-device.

    Fixes: 47b7e7f82802 ("netfilter: don't set F_IFACE on ipv6 fib lookups")
    Reported-by: Roman Mamedov <rm@romanrm.net>
    Tested-by: Roman Mamedov <rm@romanrm.net>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv6/netfilter/ip6t_rpfilter.c | 12 +++++++++++-
    1 file changed, 11 insertions(+), 1 deletion(-)

    --- a/net/ipv6/netfilter/ip6t_rpfilter.c
    +++ b/net/ipv6/netfilter/ip6t_rpfilter.c
    @@ -26,6 +26,12 @@ static bool rpfilter_addr_unicast(const
    return addr_type & IPV6_ADDR_UNICAST;
    }

    +static bool rpfilter_addr_linklocal(const struct in6_addr *addr)
    +{
    + int addr_type = ipv6_addr_type(addr);
    + return addr_type & IPV6_ADDR_LINKLOCAL;
    +}
    +
    static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
    const struct net_device *dev, u8 flags)
    {
    @@ -48,7 +54,11 @@ static bool rpfilter_lookup_reverse6(str
    }

    fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
    - if ((flags & XT_RPFILTER_LOOSE) == 0)
    +
    + if (rpfilter_addr_linklocal(&iph->saddr)) {
    + lookup_flags |= RT6_LOOKUP_F_IFACE;
    + fl6.flowi6_oif = dev->ifindex;
    + } else if ((flags & XT_RPFILTER_LOOSE) == 0)
    fl6.flowi6_oif = dev->ifindex;

    rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags);

    \
     
     \ /
      Last update: 2018-09-13 16:10    [W:4.400 / U:1.828 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site