* [PATCH nf,v4] netfilter: nf_reject_ipv6: fix locally generated packet to local address
@ 2026-10-22 15:58 Pablo Neira Ayuso
2026-10-22 17:16 ` Fernando Fernandez Mancera
0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2026-10-22 15:58 UTC (permalink / raw)
To: netfilter-devel
Fix reject expression in inet/ingress for locally generated IPv6 packets
that are sent to a local address on ethX arrives through lo, really
perform the similar handling as ip6_rcv_core().
Reported by sashiko.
Fixes: 73a73d442f99 ("netfilter: nf_reject: initialize IPCB at inet ingress")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v4: do not move route lookup before, this seems to interfer with the special loopback case.
net/ipv6/netfilter/nf_reject_ipv6.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index 5e08d8529cc8..8551e40faf04 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -445,8 +445,19 @@ void nf_send_unreach6(struct net *net, struct sk_buff *skb_in,
skb_in->dev = net->loopback_dev;
if (hooknum == NF_INET_INGRESS) {
+ const struct inet6_dev *idev;
+
memset(IP6CB(skb_in), 0, sizeof(*IP6CB(skb_in)));
- IP6CB(skb_in)->iif = skb_in->skb_iif;
+
+ if (skb_valid_dst(skb_in)) {
+ idev = ip6_dst_idev(skb_dst(skb_in));
+ if (idev)
+ IP6CB(skb_in)->iif = idev->dev->ifindex;
+ else
+ IP6CB(skb_in)->iif = skb_in->dev->ifindex;
+ } else {
+ IP6CB(skb_in)->iif = skb_in->dev->ifindex;
+ }
}
if (!skb_valid_dst(skb_in) && nf_reject6_fill_skb_dst(skb_in) < 0)
--
2.47.3
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH nf,v4] netfilter: nf_reject_ipv6: fix locally generated packet to local address
2026-10-22 15:58 [PATCH nf,v4] netfilter: nf_reject_ipv6: fix locally generated packet to local address Pablo Neira Ayuso
@ 2026-10-22 17:16 ` Fernando Fernandez Mancera
2026-10-22 22:11 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Fernando Fernandez Mancera @ 2026-10-22 17:16 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel
On 10/22/26 5:58 PM, Pablo Neira Ayuso wrote:
> Fix reject expression in inet/ingress for locally generated IPv6 packets
> that are sent to a local address on ethX arrives through lo, really
> perform the similar handling as ip6_rcv_core().
>
> Reported by sashiko.
>
> Fixes: 73a73d442f99 ("netfilter: nf_reject: initialize IPCB at inet ingress")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> v4: do not move route lookup before, this seems to interfer with the special loopback case.
>
> net/ipv6/netfilter/nf_reject_ipv6.c | 13 ++++++++++++-
> 1 file changed, 12 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
> index 5e08d8529cc8..8551e40faf04 100644
> --- a/net/ipv6/netfilter/nf_reject_ipv6.c
> +++ b/net/ipv6/netfilter/nf_reject_ipv6.c
> @@ -445,8 +445,19 @@ void nf_send_unreach6(struct net *net, struct sk_buff *skb_in,
> skb_in->dev = net->loopback_dev;
>
> if (hooknum == NF_INET_INGRESS) {
> + const struct inet6_dev *idev;
> +
> memset(IP6CB(skb_in), 0, sizeof(*IP6CB(skb_in)));
> - IP6CB(skb_in)->iif = skb_in->skb_iif;
> +
> + if (skb_valid_dst(skb_in)) {
> + idev = ip6_dst_idev(skb_dst(skb_in));
> + if (idev)
> + IP6CB(skb_in)->iif = idev->dev->ifindex;
> + else
> + IP6CB(skb_in)->iif = skb_in->dev->ifindex;
> + } else {
> + IP6CB(skb_in)->iif = skb_in->dev->ifindex;
> + }
> }
Hi Pablo, I did a bit of testing and patch LGTM.
Could we maybe simplify the code a bit by using a helper? Something like:
static int nf_reject6_ingress_iff(const struct sk_buff *skb)
{
const struct inet6_dev *idev;
if (skb_valid_dst(skb)) {
idev = ip6_dst_idev(skb_dst(skb));
if (idev)
return idev->dev->ifindex;
}
return skb->dev->ifindex;
}
Then at nf_send_unreach6() we can do:
IP6CB(skb_in)->iif = nf_reject6_ingress_iif(skb_in);
If I am not wrong, compiler should just inline the helper and there
should not be a performance hit. In addition, the code is cleaner from
my point of view.
What do you think?
>
> if (!skb_valid_dst(skb_in) && nf_reject6_fill_skb_dst(skb_in) < 0)
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH nf,v4] netfilter: nf_reject_ipv6: fix locally generated packet to local address
2026-10-22 17:16 ` Fernando Fernandez Mancera
@ 2026-10-22 22:11 ` Pablo Neira Ayuso
2026-10-23 8:04 ` Fernando Fernandez Mancera
0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2026-10-22 22:11 UTC (permalink / raw)
To: Fernando Fernandez Mancera; +Cc: netfilter-devel
On Thu, Oct 22, 2026 at 07:16:01PM +0200, Fernando Fernandez Mancera wrote:
> On 10/22/26 5:58 PM, Pablo Neira Ayuso wrote:
> > Fix reject expression in inet/ingress for locally generated IPv6 packets
> > that are sent to a local address on ethX arrives through lo, really
> > perform the similar handling as ip6_rcv_core().
> >
> > Reported by sashiko.
> >
> > Fixes: 73a73d442f99 ("netfilter: nf_reject: initialize IPCB at inet ingress")
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> > v4: do not move route lookup before, this seems to interfer with the special loopback case.
> >
> > net/ipv6/netfilter/nf_reject_ipv6.c | 13 ++++++++++++-
> > 1 file changed, 12 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
> > index 5e08d8529cc8..8551e40faf04 100644
> > --- a/net/ipv6/netfilter/nf_reject_ipv6.c
> > +++ b/net/ipv6/netfilter/nf_reject_ipv6.c
> > @@ -445,8 +445,19 @@ void nf_send_unreach6(struct net *net, struct sk_buff *skb_in,
> > skb_in->dev = net->loopback_dev;
> > if (hooknum == NF_INET_INGRESS) {
> > + const struct inet6_dev *idev;
> > +
> > memset(IP6CB(skb_in), 0, sizeof(*IP6CB(skb_in)));
> > - IP6CB(skb_in)->iif = skb_in->skb_iif;
> > +
> > + if (skb_valid_dst(skb_in)) {
> > + idev = ip6_dst_idev(skb_dst(skb_in));
> > + if (idev)
> > + IP6CB(skb_in)->iif = idev->dev->ifindex;
> > + else
> > + IP6CB(skb_in)->iif = skb_in->dev->ifindex;
> > + } else {
> > + IP6CB(skb_in)->iif = skb_in->dev->ifindex;
> > + }
> > }
>
>
> Hi Pablo, I did a bit of testing and patch LGTM.
May I have your Tested-by: tag?
> Could we maybe simplify the code a bit by using a helper? Something like:
>
> static int nf_reject6_ingress_iff(const struct sk_buff *skb)
> {
> const struct inet6_dev *idev;
>
> if (skb_valid_dst(skb)) {
> idev = ip6_dst_idev(skb_dst(skb));
> if (idev)
> return idev->dev->ifindex;
> }
>
> return skb->dev->ifindex;
> }
>
> Then at nf_send_unreach6() we can do:
>
> IP6CB(skb_in)->iif = nf_reject6_ingress_iif(skb_in);
>
> If I am not wrong, compiler should just inline the helper and there should
> not be a performance hit. In addition, the code is cleaner from my point of
> view.
>
> What do you think?
That sounds fine, I will post a v5.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH nf,v4] netfilter: nf_reject_ipv6: fix locally generated packet to local address
2026-10-22 22:11 ` Pablo Neira Ayuso
@ 2026-10-23 8:04 ` Fernando Fernandez Mancera
0 siblings, 0 replies; 4+ messages in thread
From: Fernando Fernandez Mancera @ 2026-10-23 8:04 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
On 10/23/26 12:11 AM, Pablo Neira Ayuso wrote:
> On Thu, Oct 22, 2026 at 07:16:01PM +0200, Fernando Fernandez Mancera wrote:
>> On 10/22/26 5:58 PM, Pablo Neira Ayuso wrote:
>>> Fix reject expression in inet/ingress for locally generated IPv6 packets
>>> that are sent to a local address on ethX arrives through lo, really
>>> perform the similar handling as ip6_rcv_core().
>>>
>>> Reported by sashiko.
>>>
>>> Fixes: 73a73d442f99 ("netfilter: nf_reject: initialize IPCB at inet ingress")
>>> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
>>> ---
>>> v4: do not move route lookup before, this seems to interfer with the special loopback case.
>>>
>>> net/ipv6/netfilter/nf_reject_ipv6.c | 13 ++++++++++++-
>>> 1 file changed, 12 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
>>> index 5e08d8529cc8..8551e40faf04 100644
>>> --- a/net/ipv6/netfilter/nf_reject_ipv6.c
>>> +++ b/net/ipv6/netfilter/nf_reject_ipv6.c
>>> @@ -445,8 +445,19 @@ void nf_send_unreach6(struct net *net, struct sk_buff *skb_in,
>>> skb_in->dev = net->loopback_dev;
>>> if (hooknum == NF_INET_INGRESS) {
>>> + const struct inet6_dev *idev;
>>> +
>>> memset(IP6CB(skb_in), 0, sizeof(*IP6CB(skb_in)));
>>> - IP6CB(skb_in)->iif = skb_in->skb_iif;
>>> +
>>> + if (skb_valid_dst(skb_in)) {
>>> + idev = ip6_dst_idev(skb_dst(skb_in));
>>> + if (idev)
>>> + IP6CB(skb_in)->iif = idev->dev->ifindex;
>>> + else
>>> + IP6CB(skb_in)->iif = skb_in->dev->ifindex;
>>> + } else {
>>> + IP6CB(skb_in)->iif = skb_in->dev->ifindex;
>>> + }
>>> }
>>
>>
>> Hi Pablo, I did a bit of testing and patch LGTM.
>
> May I have your Tested-by: tag?
Sure thing!
Tested-by: Fernando Fernandez Mancera <fmancera@suse.de>
>
>> Could we maybe simplify the code a bit by using a helper? Something like:
>>
>> static int nf_reject6_ingress_iff(const struct sk_buff *skb)
>> {
>> const struct inet6_dev *idev;
>>
>> if (skb_valid_dst(skb)) {
>> idev = ip6_dst_idev(skb_dst(skb));
>> if (idev)
>> return idev->dev->ifindex;
>> }
>>
>> return skb->dev->ifindex;
>> }
>>
>> Then at nf_send_unreach6() we can do:
>>
>> IP6CB(skb_in)->iif = nf_reject6_ingress_iif(skb_in);
>>
>> If I am not wrong, compiler should just inline the helper and there should
>> not be a performance hit. In addition, the code is cleaner from my point of
>> view.
>>
>> What do you think?
>
> That sounds fine, I will post a v5.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-23 8:05 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-22 15:58 [PATCH nf,v4] netfilter: nf_reject_ipv6: fix locally generated packet to local address Pablo Neira Ayuso
2026-10-22 17:16 ` Fernando Fernandez Mancera
2026-10-22 22:11 ` Pablo Neira Ayuso
2026-10-23 8:04 ` Fernando Fernandez Mancera
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.