[PATCH net v2 1/2] ipv6: honor prefix-length suppression in raw FIB lookups

[Leonard Lausen <leonard@lausen.nl>]

IPv6 raw FIB lookups populate f6i and nh in fib6_result, but not rt6.
fib6_rule_suppress() only examines rt6, so fib6_lookup() ignores
suppress_prefixlength.

With a policy rule that suppresses the main-table default before looking
in a VPN table, an ordinary route lookup selects the VPN while an nftables
FIB lookup returns the suppressed default. Strict reverse-path filtering
can then drop replies arriving over the VPN.

For raw lookups, evaluate suppress_prefixlength against the FIB entry's
destination prefix length. Preserve results marked RTF_REJECT: raw lookups
can return zero with a rejection encoded in the result, while dst-based
lookups return an error and skip suppression. Check the result flags so
blackhole nexthop objects are covered as well.

Keep the dst-based path unchanged. Raw suppress_ifgroup handling also
remains unchanged because the table lookup's nexthop need not be the
final multipath selection.

Fixes: 138118ec96cb ("net/ipv6: Add fib6_lookup")
Link: https://github.com/firewalld/firewalld/issues/1600
Assisted-by: LLM
Signed-off-by: Leonard Lausen <leonard@lausen.nl>
---
Investigated with AI assistance after VPN failures. Reproduced on
unmodified v7.4-rc2 and verified with nft_fib.sh on the rebuilt kernel.

 net/ipv6/fib6_rules.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 0ffd7b47a046..ceb4180bcf2f 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -283,9 +283,16 @@ INDIRECT_CALLABLE_SCOPE bool fib6_rule_suppress(struct fib_rule *rule,
 						struct fib_lookup_arg *arg)
 {
 	struct fib6_result *res = arg->result;
-	struct rt6_info *rt = res->rt6;
+	struct rt6_info *rt;
 	struct net_device *dev = NULL;
 
+	if (arg->lookup_ptr == fib6_table_lookup) {
+		/* Raw lookups report reject routes without an error. */
+		return !(res->fib6_flags & RTF_REJECT) &&
+		       res->f6i->fib6_dst.plen <= rule->suppress_prefixlen;
+	}
+
+	rt = res->rt6;
 	if (!rt)
 		return false;
 
-- 
2.55.0