Re: [PATCH net] ipv6: ignore link state in gateway check

[Ido Schimmel <idosch@nvidia.com>]

On Wed, Oct 28, 2026 at 03:26:33PM +0000, Yaroslav Dudkov wrote:
> IPv6 route cannot be added in table when all
> following conditions are true:
> - gateway is not link-local address
> - ignore_routes_with_linkdown=1 on device
> - nexthop has no carrier
> - gateway is not present or covered by any route in table already
> Also multipath routes addition is invalidated by kernel even
> if only one of added nexthops satisfies all above conditions.
> 
> Reproducer:
> 
>   ip netns add t
>   ip -n t link add va type veth peer name vb
>   ip -n t link set va up
>   ip -n t addr add fd00::1/64 dev va nodad
>   ip netns exec t sysctl -w \
>     net.ipv6.conf.va.ignore_routes_with_linkdown=1
>   ip -n t -6 route add 2001:db8::/64 via fd00::2 dev va
>   # added
>   ip -n t -6 route add 2001:db8::/64 table 100 via fd00::2 dev va
>   # RTNETLINK answers: No route to host
>   ip -n t -6 route show table all
>   ip netns del t
> 
> Route should be added because:
> - RT6_LOOKUP_F_IGNORE_LINKSTATE in commit d5d32e4b7668
> ("net: ipv6: Do not consider link state for nexthop validation")
> was added for this
> - the same route is valid in main table (when no specifying table id
> while adding route)
> - fib6_nh_init() initializes nexthops with no carrier
> - IPv4 already does this (fib_check_nh_v4_gw() ignores link state
> using the FIB_LOOKUP_IGNORE_LINKSTATE flag)
> 
> Before commit b2c709cce682 ("ipv6: Convert gateway validation to
> use fib6_info") rt6_lookup() was used for checking if nexthop is
> valid, rt6_lookup called rt6_device_match() which does not check the
> link state. After change rt6_lookup() to fib6_lookup()
> find_match() under fib6_lookup() started to invalidate linkdown
> devices, because RT6_LOOKUP_F_IGNORE_LINKSTATE is not passed to it.
> 
> Adding RT6_LOOKUP_F_IGNORE_LINKSTATE to flags for ip6_route_check_nh()
> solves the problem. RT6_LOOKUP_F_IGNORE_LINKSTATE is already used
> inside the first search ip6_nh_lookup_table() and fixes the
> bug in second search fib6_lookup(). Also RT6_LOOKUP_F_IGNORE_LINKSTATE
> isn't read inside fib6_select_path().
> 
> Fixes: b2c709cce682 ("ipv6: Convert gateway validation to use fib6_info")
> Signed-off-by: Yaroslav Dudkov <aroslavdudkov622@gmail.com>
> ---
> IPv4 example of this situation:
>   ip netns add t
>   ip -n t link add va type veth peer name vb
>   ip -n t link set va up
>   ip -n t addr add 192.168.0.1/24 dev va
>   ip netns exec t sysctl -w \
>     net.ipv4.conf.va.ignore_routes_with_linkdown=1
>   ip -n t route add 192.0.2.0/24 table 100 via 192.168.0.2 dev va
>   # added
>   ip -n t route show table all
>   ip netns del t

Please turn this into a selftest so that it doesn't regress in the
future. Something like [1] (vibe coded).

> 
> Also when adding RT6_LOOKUP_F_IGNORE_LINKSTATE to flags of
> ip6_route_check_nh() makes adding this flag inside of
> ip6_nh_lookup_table() unnecessary for this call, making another call in
> ip6_route_check_nh_onlink() with flags=0 the only place where it is
> needed.
> ---
>  net/ipv6/route.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index 94e5ef1c4f83..95d7b5b10e51 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -3426,7 +3426,7 @@ static int ip6_route_check_nh(struct net *net,
>  {
>  	const struct in6_addr *gw_addr = &cfg->fc_gateway;
>  	struct net_device *dev = _dev ? *_dev : NULL;
> -	int flags = RT6_LOOKUP_F_IFACE;
> +	int flags = RT6_LOOKUP_F_IFACE | RT6_LOOKUP_F_IGNORE_LINKSTATE;

Maintain reverse xmas tree:

https://docs.kernel.org/next/process/maintainer-netdev.html#local-variable-ordering-reverse-xmas-tree-rcs

>  	struct fib6_result res = {};
>  	int err = -EHOSTUNREACH;
>  
> -- 
> 2.54.0
> 

[1]
diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
index 7c47d7fe250d..76f950eaef52 100755
--- a/tools/testing/selftests/net/fib_tests.sh
+++ b/tools/testing/selftests/net/fib_tests.sh
@@ -406,10 +406,48 @@ fib_carrier_unicast_test()
 	cleanup
 }
 
+fib_carrier_gw_test()
+{
+	echo
+	echo "Gateway validation with carrier down"
+
+	setup
+
+	set -e
+	$NS_EXEC sysctl -qw net.ipv4.conf.dummy0.ignore_routes_with_linkdown=1
+	$NS_EXEC sysctl -qw net.ipv6.conf.dummy0.ignore_routes_with_linkdown=1
+	$IP link set dev dummy0 carrier off
+	sleep 1
+	set +e
+
+	$IP route add 203.0.113.0/25 via 198.51.100.2 dev dummy0
+	log_test $? 0 "IPv4 route in main table"
+	$IP -6 route add 2001:db8:10::/64 via 2001:db8:1::2 dev dummy0
+	log_test $? 0 "IPv6 route in main table"
+
+	$IP route add 203.0.113.0/25 table 100 via 198.51.100.2 dev dummy0
+	log_test $? 0 "IPv4 route in non-main table"
+	$IP -6 route add 2001:db8:10::/64 table 100 via 2001:db8:1::2 dev dummy0
+	log_test $? 0 "IPv6 route in non-main table"
+
+	$IP route add 203.0.113.128/25 table 100 via 198.51.100.2
+	log_test $? 0 "IPv4 route in non-main table without device"
+	$IP -6 route add 2001:db8:11::/64 table 100 via 2001:db8:1::2
+	log_test $? 0 "IPv6 route in non-main table without device"
+
+	$IP route show table 100 203.0.113.0/25 | grep -q "linkdown"
+	log_test $? 0 "IPv4 linkdown flag set"
+	$IP -6 route show table 100 2001:db8:10::/64 | grep -q "linkdown"
+	log_test $? 0 "IPv6 linkdown flag set"
+
+	cleanup
+}
+
 fib_carrier_test()
 {
 	fib_carrier_local_test
 	fib_carrier_unicast_test
+	fib_carrier_gw_test
 }
 
 fib_rp_filter_test()