Re: [PATCH net v2] ipv6: enforce egress device match in per table nexthop lookups

[Paolo Abeni <pabeni@redhat.com>]

On Thu, 2016-06-23 at 08:29 -0600, David Ahern wrote:
> On 6/23/16 8:20 AM, David Ahern wrote:
> >> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> >> index 969913d..520b788 100644
> >> --- a/net/ipv6/route.c
> >> +++ b/net/ipv6/route.c
> >> @@ -1782,7 +1782,7 @@ static struct rt6_info
> >> *ip6_nh_lookup_table(struct net *net,
> >>      };
> >>      struct fib6_table *table;
> >>      struct rt6_info *rt;
> >> -    int flags = 0;
> >> +    int flags = RT6_LOOKUP_F_IFACE;
> >>
> >>      table = fib6_get_table(net, cfg->fc_table);
> >>      if (!table)
> >>
> >
> > Acked-by: David Ahern <dsa@cumulusnetworks.com>
> 
> I take that back.
> 
> I think RT6_LOOKUP_F_IFACE should only be set if cfg->fc_ifindex is set.

AFAICS the latter condition should not be needed. The related
information is passed all way down to rt6_score_route(), where it's
really used:

	m = rt6_check_dev(rt, oif);
        if (!m && (strict & RT6_LOOKUP_F_IFACE))
                return RT6_NUD_FAIL_HARD;

and 'm' can be 0 only if oif is set: RT6_LOOKUP_F_IFACE has no effect
ifindex is set.

Paolo