ipv6: Preserve link scope traffic original oif

Submitted by Alin Năstac on March 1, 2017, 1:47 p.m.

Details

Message ID 1488376043-31976-1-git-send-email-alin.nastac@gmail.com
State Under Review
Delegated to: Pablo Neira
Headers show

Commit Message

Alin Năstac March 1, 2017, 1:47 p.m.
Link-local and multicast packets must keep their original oif after
ip6_route_me_harder is called.

Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
---
 net/ipv6/netfilter.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Pablo Neira March 3, 2017, 11:39 a.m.
On Wed, Mar 01, 2017 at 02:47:23PM +0100, Alin Nastac wrote:
> Link-local and multicast packets must keep their original oif after
> ip6_route_me_harder is called.

Out of curiosity, how does the setup you use look like to trigger this
problem?
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Alin Năstac March 3, 2017, 11:56 a.m.
On Fri, Mar 3, 2017 at 12:39 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Mar 01, 2017 at 02:47:23PM +0100, Alin Nastac wrote:
>> Link-local and multicast packets must keep their original oif after
>> ip6_route_me_harder is called.
>
> Out of curiosity, how does the setup you use look like to trigger this
> problem?

ICMPv6 RA/NS/NA are marked by a -j MARK iptables rule (the mark value
is used to set the QoS queue).
Because skb->mark value changed, ip6t_mangle_out will call ip6_route_me_harder.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Pablo Neira March 3, 2017, 12:12 p.m.
On Fri, Mar 03, 2017 at 12:56:50PM +0100, Alin Năstac wrote:
> On Fri, Mar 3, 2017 at 12:39 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Wed, Mar 01, 2017 at 02:47:23PM +0100, Alin Nastac wrote:
> >> Link-local and multicast packets must keep their original oif after
> >> ip6_route_me_harder is called.
> >
> > Out of curiosity, how does the setup you use look like to trigger this
> > problem?
> 
> ICMPv6 RA/NS/NA are marked by a -j MARK iptables rule (the mark value
> is used to set the QoS queue).
> Because skb->mark value changed, ip6t_mangle_out will call ip6_route_me_harder.

That sounds quite standard. Did this broke after kernel upgrade? I'm
trying to guess if the problem is somewhere else...
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Alin Năstac March 3, 2017, 1:22 p.m.
On Fri, Mar 3, 2017 at 1:12 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Fri, Mar 03, 2017 at 12:56:50PM +0100, Alin Năstac wrote:
>> On Fri, Mar 3, 2017 at 12:39 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>> > On Wed, Mar 01, 2017 at 02:47:23PM +0100, Alin Nastac wrote:
>> >> Link-local and multicast packets must keep their original oif after
>> >> ip6_route_me_harder is called.
>> >
>> > Out of curiosity, how does the setup you use look like to trigger this
>> > problem?
>>
>> ICMPv6 RA/NS/NA are marked by a -j MARK iptables rule (the mark value
>> is used to set the QoS queue).
>> Because skb->mark value changed, ip6t_mangle_out will call ip6_route_me_harder.
>
> That sounds quite standard. Did this broke after kernel upgrade? I'm
> trying to guess if the problem is somewhere else...

I used kernel version 4.1 to test an adapted version of this patch.

Judging after ip6_route_output_flags() definition present in kernel
version 4.10, callers are expected to provide a valid value for
fl6->flowi6_oif when rt6_need_strict(&fl6->daddr) is true.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch hide | download patch | download mbox

diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 39970e2..02811c5 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -24,7 +24,8 @@  int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
 	unsigned int hh_len;
 	struct dst_entry *dst;
 	struct flowi6 fl6 = {
-		.flowi6_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
+		.flowi6_oif = skb->sk ? skb->sk->sk_bound_dev_if :
+			rt6_need_strict(&iph->daddr) ? skb_dst(skb)->dev->ifindex : 0,
 		.flowi6_mark = skb->mark,
 		.flowi6_uid = sock_net_uid(net, skb->sk),
 		.daddr = iph->daddr,