Roman Mamedov <[email protected]> wrote:
> I have a machine which is a DHCPv6 client on a PPPoE connection. It also has:
>
> sysctl -w net.netfilter.nf_conntrack_tcp_loose=0
> ip6tables -t raw -A PREROUTING ! -i lo -m rpfilter --invert -j DROP
>
> After commits:
>
> netfilter: don't set F_IFACE on ipv6 fib lookups
> http://patchwork.ozlabs.org/patch/873574/
>
> netfilter: ip6t_rpfilter: provide input interface for route lookup
> https://patchwork.ozlabs.org/patch/919290/
>
> ...the DHCPv6 client no longer sees any replies from the server. They are now
> filtered out by rpfilter. Removing the ip6tables rule shown above, or rolling
> back both of these commits, makes it all work fine again.
>
> From commit messages it doesn't appear like this would be a "by design"
> behavior of these changes.
>
> I did not test if other kernel branches (4.17 et al) are affected, but if they
> also have both of these, I guess they likely are.
Safe bet.
Does this patch fix the problem for you?
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c
b/net/ipv6/netfilter/ip6t_rpfilter.c
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -26,6 +26,12 @@ static bool rpfilter_addr_unicast(const struct in6_addr
*addr)
return addr_type & IPV6_ADDR_UNICAST;
}
+static bool rpfilter_addr_linklocal(const struct in6_addr *addr)
+{
+ int addr_type = ipv6_addr_type(addr);
+ return addr_type & IPV6_ADDR_LINKLOCAL;
+}
+
static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff
*skb,
const struct net_device *dev, u8 flags)
{
@@ -48,7 +54,11 @@ static bool rpfilter_lookup_reverse6(struct net *net, const
struct sk_buff *skb,
}
fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
- if ((flags & XT_RPFILTER_LOOSE) == 0)
+
+ if (rpfilter_addr_linklocal(&iph->saddr)) {
+ lookup_flags |= RT6_LOOKUP_F_IFACE;
+ fl6.flowi6_oif = dev->ifindex;
+ } else if ((flags & XT_RPFILTER_LOOSE) == 0)
fl6.flowi6_oif = dev->ifindex;
rt = (void *) ip6_route_lookup(net, &fl6, lookup_flags);
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
