[RFC PATCH bpf-next 8/9] bpf: fib_lookup: Allow output lookups for IPv6 link-local addresses

[Ido Schimmel <idosch@nvidia.com>]

Currently, the bpf_fib_lookup() helper returns an error when IPv6
link-local addresses are used. This is the correct behavior from input
perspective as such packets should not be forwarded, but the helper can
also be used to perform a lookup from output perspective (i.e., with
BPF_FIB_LOOKUP_OUTPUT). In this case, passing IPv6 link-local addresses
should be allowed and one legitimate use case is having the helper
resolve the destination MAC for such packets.

Therefore, relax the limitation and allow IPv6 link-local addresses when
the BPF_FIB_LOOKUP_OUTPUT flag is used.

Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/core/filter.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index e92552b139b1..8f0d2aeffc3d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6241,8 +6241,15 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
 	u32 mtu = 0;
 
 	/* link local addresses are never forwarded */
-	if (rt6_need_strict(dst) || rt6_need_strict(src))
-		return BPF_FIB_LKUP_RET_NOT_FWDED;
+	if (rt6_need_strict(dst) || rt6_need_strict(src)) {
+		int rej_type = IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK;
+
+		if (!(flags & BPF_FIB_LOOKUP_OUTPUT))
+			return BPF_FIB_LKUP_RET_NOT_FWDED;
+		if ((ipv6_addr_type(dst) & rej_type) ||
+		    (ipv6_addr_type(src) & rej_type))
+			return BPF_FIB_LKUP_RET_NOT_FWDED;
+	}
 
 	dev = dev_get_by_index_rcu(net, params->ifindex);
 	if (unlikely(!dev))
-- 
2.53.0