Re: [PATCH net] net: vrf: Set L3MDEV OIF flag for outbound lookups

[Gabriel Goller <g.goller@proxmox.com>]

On 27.10.2026 01:47, Haon KIM wrote:
> The IPv4 and IPv6 outbound processing paths in the VRF driver
> set the L3 master device index in the flow structure before
> performing route lookups, but do not set
> FLOWI_FLAG_L3MDEV_OIF.
> 
> Both the IPv4 and IPv6 outbound processing paths contain
> the comment "needed to match OIF rule", indicating that
> the L3 master device index is needed to match OIF rules.
> However, FIB rule matching requires both
> FLOWI_FLAG_L3MDEV_OIF and a matching flowi_l3mdev index
> to match a rule specifying the VRF master as the output
> interface.
> 
> The matching logic introduced by commit 2d300ce0b783
> ("net: fib_rules: Fix iif / oif matching on L3 master device")
> requires FLOWI_FLAG_L3MDEV_OIF to be set for OIF rules to
> match the VRF master. The existing outbound processing paths
> set the L3 master device index directly, so
> l3mdev_update_flow() does not set this flag.
> 
> Consequently, OIF rules specifying the VRF master may fail
> to match these flows.
> 
> Set FLOWI_FLAG_L3MDEV_OIF in both outbound processing paths
> so that FIB rules can correctly match the VRF master as the
> output interface.
> 
> The issue was identified by code inspection. Runtime testing
> has not been performed.
> 
> Fixes: 2d300ce0b783 ("net: fib_rules: Fix iif / oif matching on L3 master device")

I think this should be:

Fixes: 40867d74c374 ("net: Add l3mdev index to flow struct and avoid oif reset for port devices")

> Signed-off-by: Haon KIM <akrn112@naver.com>
> ---
>  drivers/net/vrf.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
> index 79d433f49f80..f22ac91fefd4 100644
> --- a/drivers/net/vrf.c
> +++ b/drivers/net/vrf.c
> @@ -432,6 +432,7 @@ static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
>  	fl6.flowlabel = ip6_flowinfo(iph);
>  	fl6.flowi6_mark = skb->mark;
>  	fl6.flowi6_proto = iph->nexthdr;
> +	fl6.flowi6_flags = FLOWI_FLAG_L3MDEV_OIF;
>  
>  	dst = ip6_dst_lookup_flow(net, NULL, &fl6, NULL);
>  	if (IS_ERR(dst) || dst == dst_null)
> @@ -506,7 +507,7 @@ static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb,
>  	fl4.flowi4_l3mdev = vrf_dev->ifindex;
>  	fl4.flowi4_iif = LOOPBACK_IFINDEX;
>  	fl4.flowi4_dscp = ip4h_dscp(ip4h);
> -	fl4.flowi4_flags = FLOWI_FLAG_ANYSRC;
> +	fl4.flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_L3MDEV_OIF;
>  	fl4.flowi4_proto = ip4h->protocol;
>  	fl4.daddr = ip4h->daddr;
>  	fl4.saddr = ip4h->saddr;

Also this is a breaking change, before the patch, this rule matched:

   ip rule add iif vrf0 table 100

After the patch, this one matches (and the iif rule above no longer does):

   ip rule add oif vrf0 table 100

A selftest would also be nice.

Thanks,
Gabriel