From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH net] net/ipv6: Fix route leaking between VRFs Date: Fri, 30 Mar 2018 14:24:38 -0400 (EDT) Message-ID: <20180330.142438.1818786940199572848.davem@davemloft.net> References: <20180330004457.814-1-dsahern@gmail.com> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, sharpd@cumulusnetworks.com To: dsahern@gmail.com Return-path: Received: from shards.monkeyblade.net ([184.105.139.130]:34192 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751180AbeC3SYj (ORCPT ); Fri, 30 Mar 2018 14:24:39 -0400 In-Reply-To: <20180330004457.814-1-dsahern@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: From: David Ahern Date: Thu, 29 Mar 2018 17:44:57 -0700 > Donald reported that IPv6 route leaking between VRFs is not working. > The root cause is the strict argument in the call to rt6_lookup when > validating the nexthop spec. > > ip6_route_check_nh validates the gateway and device (if given) of a > route spec. It in turn could call rt6_lookup (e.g., lookup in a given > table did not succeed so it falls back to a full lookup) and if so > sets the strict argument to 1. That means if the egress device is given, > the route lookup needs to return a result with the same device. This > strict requirement does not work with VRFs (IPv4 or IPv6) because the > oif in the flow struct is overridden with the index of the VRF device > to trigger a match on the l3mdev rule and force the lookup to its table. > > The right long term solution is to add an l3mdev index to the flow > struct such that the oif is not overridden. That solution will not > backport well, so this patch aims for a simpler solution to relax the > strict argument if the route spec device is an l3mdev slave. As done > in other places, use the FLOWI_FLAG_SKIP_NH_OIF to know that the > RT6_LOOKUP_F_IFACE flag needs to be removed. > > Reported-by: Donald Sharp > Signed-off-by: David Ahern Applied, with fixes tag added, and queued up for -stable. Thanks.