From: Florian Westphal <fw@strlen.de>
To: Liping Zhang <zlpnobody@163.com>
Cc: pablo@netfilter.org, netfilter-devel@vger.kernel.org,
fw@strlen.de, Liping Zhang <zlpnobody@gmail.com>
Subject: Re: [PATCH nf-next] netfilter: nft_fib: store loopback interface to dreg when rt is local
Date: Thu, 24 Nov 2016 14:50:14 +0100 [thread overview]
Message-ID: <20161124135014.GD24598@breakpoint.cc> (raw)
In-Reply-To: <1479994128-16654-1-git-send-email-zlpnobody@163.com>
Liping Zhang <zlpnobody@163.com> wrote:
> In general, we haven't do routing lookup in PREROUTING hook, so it's
> very likely that fib4/6_is_local will not be met.
loopback packets retain skb->dst (and thats what this test is about).
> Then the *dest will
> be set to 0 because we do nothing when the fib result is RTN_LOCAL.
Yes.
> So if the user want to drop all packets which cannot be routed,
> and input the following nft rule:
> # nft add rule filter prerouting fib daddr oif eq 0 drop
>
> Then all the packets which destinate to local will be dropped
> incorrectly.
but in "saddr oif eq 0 drop" case they really should have no oif, the
address should not be considered routeable.
Pablo, please don't apply this; I would like to look at this next week.
Msybe this needs a check if we're testing daddr or saddr.
next prev parent reply other threads:[~2016-11-24 13:53 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-24 13:28 [PATCH nf-next] netfilter: nft_fib: store loopback interface to dreg when rt is local Liping Zhang
2016-11-24 13:50 ` Florian Westphal [this message]
2016-11-24 14:31 ` Liping Zhang
2016-11-24 14:48 ` Florian Westphal
2016-11-25 13:47 ` Liping Zhang
2016-11-28 12:25 ` Florian Westphal
2016-11-30 10:18 ` Liping Zhang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161124135014.GD24598@breakpoint.cc \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=zlpnobody@163.com \
--cc=zlpnobody@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.