lkml.org 
[lkml]   [2019]   [Apr]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH v2] net: netfilter: Fix ipv6 rp_filter dropping vrf packets by mistake
Date
From: Miaohe Lin <linmiaohe@huawei.com>

When firewall is enabled with rp_filter, vrf ipv6 packets
will be dropped because in device is vrf but out device
is an enslaved device. So rt->rt6i_idev->dev != dev and
maybe return false in func rpfilter_lookup_reverse6.

Here is the out message when I ping the peer:
ip vrf exec vrf1 ping 2013::2 -c 1
1 packets transmitted, 0 received, 100% packet loss, time 0ms

The drop info in /var/log/message:
Apr 24 14:59:45 localhost kernel: [81316.158259] rpfilter_DROP: IN=vrf1
OUT= MAC=52:54:00:9e:dd:c1:52:54:00:4f:81:38:86:dd
SRC=2013:0000:0000:0000:0000:0000:0000:0002
DST=2013:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=0 HOPLIMIT=64
FLOWLBL=1032942 PROTO=ICMPv6 TYPE=129 CODE=0 ID=14943 SEQ=1

Signed-off-by: linmiaohe <linmiaohe@huawei.com>
---
net/ipv6/netfilter/ip6t_rpfilter.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index c3c6b09acdc4..cf1070ab1252 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -73,6 +73,12 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
goto out;
}

+ if (netif_is_l3_master(dev)) {
+ dev = dev_get_by_index_rcu(dev_net(dev), IP6CB(skb)->iif);
+ if (!dev)
+ goto out;
+ }
+
if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE))
ret = true;
out:
--
2.19.1

\
 
 \ /
  Last update: 2019-04-24 11:13    [W:0.039 / U:0.092 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site