[PATCH net v2 0/2] ipv6: honor prefix-length suppression in raw FIB lookups

[Leonard Lausen <leonard@lausen.nl>]

Following Sashiko's automated review, v2 is limited to
suppress_prefixlength. The review identified that v1 evaluated
suppress_ifgroup before final multipath selection; I reproduced the
resulting disagreement between raw and ordinary lookups. Interface-group
suppression needs separate work and is left unchanged in this revision.

Prefix suppression is sufficient for the reported VPN failure: nftables
can otherwise return a main-table default that an ordinary lookup
suppresses before continuing to the VPN table. Strict reverse-path
filtering then drops replies arriving through the VPN.

Patch 1 adds a raw prefix-length check while preserving RTF_REJECT results
and leaving dst-based handling unchanged. Patch 2 extends nft_fib.sh with
six checks using its existing topology and counter helper.

Changes since v1:
- Drop raw suppress_ifgroup support and its tests. Table lookup can return
  a different nexthop from the final multipath selection used by ordinary
  routing and BPF, so suppression cannot safely use that initial device.
- Install the router's logging RPF rules after the suppression checks and
  policy-rule cleanup. This prevents neighbour advertisements from being
  logged and dropped during intentionally different reverse-route states.
- Add a blackhole nexthop-object case, which distinguishes rejection flags
  in the lookup result from those in the FIB entry.

V1: https://lore.kernel.org/netdev/20261110131638.15004-3-leonard@lausen.nl/

Tested on the rebuilt v7.4-rc2-based kernel: all six added checks pass,
and the full nft_fib.sh run exits 0. A run with an eight-second delay also
passes, allowing neighbour discovery to complete. Separate probes confirm
that reject routes remain terminal and raw interface-group suppression
is unchanged.

OpenAI Codex assisted with investigation, reproduction, implementation,
tests and descriptions. The prompts asked it to investigate the
Wireguard VPN failure.

Leonard Lausen (2):
  ipv6: honor prefix-length suppression in raw FIB lookups
  selftests: netfilter: cover IPv6 FIB prefix suppression

 net/ipv6/fib6_rules.c                         |  9 ++-
 .../selftests/net/netfilter/nft_fib.sh        | 63 ++++++++++++++++++-
 2 files changed, 70 insertions(+), 2 deletions(-)


base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.55.0