[PATCH net] net: vrf: Set L3MDEV OIF flag for outbound lookups

[PATCH net] net: vrf: Set L3MDEV OIF flag for outbound lookups

[Haon KIM]

The IPv4 and IPv6 outbound processing paths in the VRF driver
set the L3 master device index in the flow structure before
performing route lookups, but do not set
FLOWI_FLAG_L3MDEV_OIF.

Both the IPv4 and IPv6 outbound processing paths contain
the comment "needed to match OIF rule", indicating that
the L3 master device index is needed to match OIF rules.
However, FIB rule matching requires both
FLOWI_FLAG_L3MDEV_OIF and a matching flowi_l3mdev index
to match a rule specifying the VRF master as the output
interface.

The matching logic introduced by commit 2d300ce0b783
("net: fib_rules: Fix iif / oif matching on L3 master device")
requires FLOWI_FLAG_L3MDEV_OIF to be set for OIF rules to
match the VRF master. The existing outbound processing paths
set the L3 master device index directly, so
l3mdev_update_flow() does not set this flag.

Consequently, OIF rules specifying the VRF master may fail
to match these flows.

Set FLOWI_FLAG_L3MDEV_OIF in both outbound processing paths
so that FIB rules can correctly match the VRF master as the
output interface.

The issue was identified by code inspection. Runtime testing
has not been performed.

Fixes: 2d300ce0b783 ("net: fib_rules: Fix iif / oif matching on L3 master device")
Signed-off-by: Haon KIM <akrn112@naver.com>
---
 drivers/net/vrf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 79d433f49f80..f22ac91fefd4 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -432,6 +432,7 @@ static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
 	fl6.flowlabel = ip6_flowinfo(iph);
 	fl6.flowi6_mark = skb->mark;
 	fl6.flowi6_proto = iph->nexthdr;
+	fl6.flowi6_flags = FLOWI_FLAG_L3MDEV_OIF;
 
 	dst = ip6_dst_lookup_flow(net, NULL, &fl6, NULL);
 	if (IS_ERR(dst) || dst == dst_null)
@@ -506,7 +507,7 @@ static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb,
 	fl4.flowi4_l3mdev = vrf_dev->ifindex;
 	fl4.flowi4_iif = LOOPBACK_IFINDEX;
 	fl4.flowi4_dscp = ip4h_dscp(ip4h);
-	fl4.flowi4_flags = FLOWI_FLAG_ANYSRC;
+	fl4.flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_L3MDEV_OIF;
 	fl4.flowi4_proto = ip4h->protocol;
 	fl4.daddr = ip4h->daddr;
 	fl4.saddr = ip4h->saddr;
-- 
2.37.0

Re: [PATCH net] net: vrf: Set L3MDEV OIF flag for outbound lookups

[Gabriel Goller]

On 27.10.2026 01:47, Haon KIM wrote:
> The IPv4 and IPv6 outbound processing paths in the VRF driver
> set the L3 master device index in the flow structure before
> performing route lookups, but do not set
> FLOWI_FLAG_L3MDEV_OIF.
> 
> Both the IPv4 and IPv6 outbound processing paths contain
> the comment "needed to match OIF rule", indicating that
> the L3 master device index is needed to match OIF rules.
> However, FIB rule matching requires both
> FLOWI_FLAG_L3MDEV_OIF and a matching flowi_l3mdev index
> to match a rule specifying the VRF master as the output
> interface.
> 
> The matching logic introduced by commit 2d300ce0b783
> ("net: fib_rules: Fix iif / oif matching on L3 master device")
> requires FLOWI_FLAG_L3MDEV_OIF to be set for OIF rules to
> match the VRF master. The existing outbound processing paths
> set the L3 master device index directly, so
> l3mdev_update_flow() does not set this flag.
> 
> Consequently, OIF rules specifying the VRF master may fail
> to match these flows.
> 
> Set FLOWI_FLAG_L3MDEV_OIF in both outbound processing paths
> so that FIB rules can correctly match the VRF master as the
> output interface.
> 
> The issue was identified by code inspection. Runtime testing
> has not been performed.
> 
> Fixes: 2d300ce0b783 ("net: fib_rules: Fix iif / oif matching on L3 master device")

I think this should be:

Fixes: 40867d74c374 ("net: Add l3mdev index to flow struct and avoid oif reset for port devices")

> Signed-off-by: Haon KIM <akrn112@naver.com>
> ---
>  drivers/net/vrf.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
> index 79d433f49f80..f22ac91fefd4 100644
> --- a/drivers/net/vrf.c
> +++ b/drivers/net/vrf.c
> @@ -432,6 +432,7 @@ static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
>  	fl6.flowlabel = ip6_flowinfo(iph);
>  	fl6.flowi6_mark = skb->mark;
>  	fl6.flowi6_proto = iph->nexthdr;
> +	fl6.flowi6_flags = FLOWI_FLAG_L3MDEV_OIF;
>  
>  	dst = ip6_dst_lookup_flow(net, NULL, &fl6, NULL);
>  	if (IS_ERR(dst) || dst == dst_null)
> @@ -506,7 +507,7 @@ static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb,
>  	fl4.flowi4_l3mdev = vrf_dev->ifindex;
>  	fl4.flowi4_iif = LOOPBACK_IFINDEX;
>  	fl4.flowi4_dscp = ip4h_dscp(ip4h);
> -	fl4.flowi4_flags = FLOWI_FLAG_ANYSRC;
> +	fl4.flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_L3MDEV_OIF;
>  	fl4.flowi4_proto = ip4h->protocol;
>  	fl4.daddr = ip4h->daddr;
>  	fl4.saddr = ip4h->saddr;

Also this is a breaking change, before the patch, this rule matched:

   ip rule add iif vrf0 table 100

After the patch, this one matches (and the iif rule above no longer does):

   ip rule add oif vrf0 table 100

A selftest would also be nice.

Thanks,
Gabriel

Re: [PATCH net] net: vrf: Set L3MDEV OIF flag for outbound lookups

[David Ahern]

[ cc author of referenced Fixes commit ]

On 10/28/26 7:57 AM, Gabriel Goller wrote:
> On 27.10.2026 01:47, Haon KIM wrote:
>> The IPv4 and IPv6 outbound processing paths in the VRF driver
>> set the L3 master device index in the flow structure before
>> performing route lookups, but do not set
>> FLOWI_FLAG_L3MDEV_OIF.
>>
>> Both the IPv4 and IPv6 outbound processing paths contain
>> the comment "needed to match OIF rule", indicating that
>> the L3 master device index is needed to match OIF rules.
>> However, FIB rule matching requires both
>> FLOWI_FLAG_L3MDEV_OIF and a matching flowi_l3mdev index
>> to match a rule specifying the VRF master as the output
>> interface.
>>
>> The matching logic introduced by commit 2d300ce0b783
>> ("net: fib_rules: Fix iif / oif matching on L3 master device")
>> requires FLOWI_FLAG_L3MDEV_OIF to be set for OIF rules to
>> match the VRF master. The existing outbound processing paths
>> set the L3 master device index directly, so
>> l3mdev_update_flow() does not set this flag.
>>
>> Consequently, OIF rules specifying the VRF master may fail
>> to match these flows.
>>
>> Set FLOWI_FLAG_L3MDEV_OIF in both outbound processing paths
>> so that FIB rules can correctly match the VRF master as the
>> output interface.
>>
>> The issue was identified by code inspection. Runtime testing
>> has not been performed.

Please do not do that; do some testing before sending patches.

>>
>> Fixes: 2d300ce0b783 ("net: fib_rules: Fix iif / oif matching on L3 master device")
> 
> I think this should be:
> 
> Fixes: 40867d74c374 ("net: Add l3mdev index to flow struct and avoid oif reset for port devices")

No, the Fixes above is correct if there is a bug; the
FLOWI_FLAG_L3MDEV_OIF flag was introduced by 2d300ce0b783 and was not
present for 40867d74c374.

That said, unless I am misremembering something the flag does not need
to be set in this outbound path.

> 
>> Signed-off-by: Haon KIM <akrn112@naver.com>
>> ---
>>  drivers/net/vrf.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
>> index 79d433f49f80..f22ac91fefd4 100644
>> --- a/drivers/net/vrf.c
>> +++ b/drivers/net/vrf.c
>> @@ -432,6 +432,7 @@ static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
>>  	fl6.flowlabel = ip6_flowinfo(iph);
>>  	fl6.flowi6_mark = skb->mark;
>>  	fl6.flowi6_proto = iph->nexthdr;
>> +	fl6.flowi6_flags = FLOWI_FLAG_L3MDEV_OIF;
>>  
>>  	dst = ip6_dst_lookup_flow(net, NULL, &fl6, NULL);
>>  	if (IS_ERR(dst) || dst == dst_null)
>> @@ -506,7 +507,7 @@ static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb,
>>  	fl4.flowi4_l3mdev = vrf_dev->ifindex;
>>  	fl4.flowi4_iif = LOOPBACK_IFINDEX;
>>  	fl4.flowi4_dscp = ip4h_dscp(ip4h);
>> -	fl4.flowi4_flags = FLOWI_FLAG_ANYSRC;
>> +	fl4.flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_L3MDEV_OIF;
>>  	fl4.flowi4_proto = ip4h->protocol;
>>  	fl4.daddr = ip4h->daddr;
>>  	fl4.saddr = ip4h->saddr;
> 
> Also this is a breaking change, before the patch, this rule matched:
> 
>    ip rule add iif vrf0 table 100
> 
> After the patch, this one matches (and the iif rule above no longer does):
> 
>    ip rule add oif vrf0 table 100
> 
> A selftest would also be nice.

See commit message in cited Fixes commit. Have you checked
fib_rule_tests.sh? If not, try the commands in 2d300ce0b783 and if they
are broken, there is a problem. If not, let's get them added to the
selftest.