Re: [PATCH net-next v2] ipv6: honor per-interface proxy_ndp in forward and NA paths

[Jakub Kicinski <kuba@kernel.org>]

On Mon, 29 Jun 2026 15:59:00 +0200 Nicolas Dichtel wrote:
> Le 29/06/2026 à 08:18, Chenguang Zhao a écrit :
> > ndisc_recv_ns() has always checked both devconf_all and idev->cnf for
> > proxy_ndp, but ip6_forward() and ndisc_recv_na() only looked at the
> > global setting. The original commit left XXX comments in these paths
> > likely because idev was not available there at the time; ip6_forward()
> > now obtains idev from IP6CB(skb)->iif.
> > 
> > Honor per-interface proxy_ndp in both places to match the NS path and
> > allow setups that only enable proxy_ndp on specific interfaces.
> > 
> > In ip6_forward(), idev is looked up via the ingress interface (iif) while
> > pneigh_lookup() uses skb->dev. For ND packets this is correct because
> > vrf_ip6_rcv() does not modify skb->dev for neighbour discovery frames,
> > so both refer to the ingress interface.
> > 
> > Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
> > ---
> > v2:
> >  Per Ido's review, the following changes were made in v2:
> >  - Target net-next instead of net
> >  - Drop Fixes tag
> >  - Expand commit message: XXX comment history, idev vs skb->dev for ND packets
> >  - Fix subject prefix
> > 
> > v1:
> >  - https://lore.kernel.org/all/20260623085600.396401-1-zhaochenguang@kylinos.cn/
> > 
> >  net/ipv6/ip6_output.c | 4 ++--
> >  net/ipv6/ndisc.c      | 4 ++--
> >  2 files changed, 4 insertions(+), 4 deletions(-)
> > 
> > diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> > index 368e4fa3b43c..c4ca4a813479 100644
> > --- a/net/ipv6/ip6_output.c
> > +++ b/net/ipv6/ip6_output.c
> > @@ -579,8 +579,8 @@ int ip6_forward(struct sk_buff *skb)
> >  		return -ETIMEDOUT;
> >  	}
> >  
> > -	/* XXX: idev->cnf.proxy_ndp? */
> > -	if (READ_ONCE(net->ipv6.devconf_all->proxy_ndp) &&
> > +	if ((READ_ONCE(net->ipv6.devconf_all->proxy_ndp) ||
> > +	     (idev && READ_ONCE(idev->cnf.proxy_ndp))) &&  
> As stated by Ido, this changes a 20 years old user-visible behavior. It suddenly
> may enable proxy NDP on a system.
> I was thinking that this kind of change was prohibited.

Chenguang Zhao, is this a change you find useful or are you just
acting on an AI-generated port about inconsistency in behavior?
Could you please explain your use case / deployment scenario?