[PATCH] net/ipv6/route.c: packets originating on device match lo

[PATCH] net/ipv6/route.c: packets originating on device match lo

[David McCullough]

Hi all,

Seems like the special case of "iif lo" when using rules to control packets
is broken for IPv6 traffic.  The section from the ip man page is:

   iif NAME
          select  the incoming device to match.  If the interface is loop‐
          back, the rule only matches packets originating from this  host.
          This  means that you may create separate routing tables for for‐
          warded and local packets and, hence, completely segregate them.

If I run the following configuration:

    ifconfig eth0 192.168.0.1 netmask 255.255.255.0
    ip addr add fec0:0:0:2::1/64 dev eth0

    ip route add table 200 unreachable default
    ip -6 route add table 200 unreachable default

    ip rule add to 192.168.0.2 table 200 iif lo
    ip -6 rule add to fec0:0:0:2::2 table 200 iif lo

and then test with:

    # ping 192.168.0.2
    connect: Network is unreachable
    # ping6 fec0:0:0:2::2
    PING fec0:0:0:2::2(fec0:0:0:2::2) 56 data bytes
    64 bytes from fec0:0:0:2::2: icmp_seq=1 ttl=64 time=0.648 ms
    ...

The patch below is against linux-3.4.  I am not sure if its the best
solution but it appears to fix the case above:

    # ping6 fec0:0:0:2::2
    connect: Network is unreachable

and does not appear to affect forwarded packets is the few cases I have
tried.  Tested on linux-3.4 and iproute2-3.4.0, Feedback appreciated :-)

Thanks,
Davidm

Signed-off-by: David McCullough <david_mccullough@mcafee.com>

diff -p -u -r1.1.1.59 route.c
--- linux-3.4/net/ipv6/route.c	21 May 2012 23:15:01 -0000	1.1.1.59
+++ linux-3.4/net/ipv6/route.c	25 Jun 2012 05:43:50 -0000
@@ -931,6 +931,9 @@ struct dst_entry * ip6_route_output(stru
 {
 	int flags = 0;
 
+	if (fl6->flowi6_iif == 0)
+		fl6->flowi6_iif = net->loopback_dev->ifindex;
+		
 	if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl6->daddr))
 		flags |= RT6_LOOKUP_F_IFACE;
 

-- 
David McCullough,      david_mccullough@mcafee.com,  Ph:+61 734352815
McAfee - SnapGear      http://www.mcafee.com         http://www.uCdot.org

Re: [PATCH] net/ipv6/route.c: packets originating on device match lo

[David Miller]

From: David McCullough <david_mccullough@mcafee.com>
Date: Mon, 25 Jun 2012 16:50:30 +1000

> @@ -931,6 +931,9 @@ struct dst_entry * ip6_route_output(stru
>  {
>  	int flags = 0;
>  
> +	if (fl6->flowi6_iif == 0)
> +		fl6->flowi6_iif = net->loopback_dev->ifindex;
> +		

Like ipv4, you should make this assignment unconditionally.

Thanks.

Re: [PATCH] net/ipv6/route.c: packets originating on device match lo

[David McCullough]

Jivin David Miller lays it down ...
> From: David McCullough <david_mccullough@mcafee.com>
> Date: Mon, 25 Jun 2012 16:50:30 +1000
> 
> > @@ -931,6 +931,9 @@ struct dst_entry * ip6_route_output(stru
> >  {
> >  	int flags = 0;
> >  
> > +	if (fl6->flowi6_iif == 0)
> > +		fl6->flowi6_iif = net->loopback_dev->ifindex;
> > +		
> 
> Like ipv4, you should make this assignment unconditionally.

No problems, will resend,  I wasn't so sure that I could do that safely
with the flowi getting passed into IPv6 rather than created as it is in
IPv4.  Did some extra testing,  looks good so patch to follow,

Thanks,
Davidm

-- 
David McCullough,      david_mccullough@mcafee.com,  Ph:+61 734352815
McAfee - SnapGear      http://www.mcafee.com         http://www.uCdot.org