Re: [RFC PATCH bpf-next 8/9] bpf: fib_lookup: Allow output lookups for IPv6 link-local addresses

[David Ahern <dsahern@gmail.com>]

On 2/26/26 1:00 AM, Ido Schimmel wrote:
> Currently, the bpf_fib_lookup() helper returns an error when IPv6
> link-local addresses are used. This is the correct behavior from input
> perspective as such packets should not be forwarded, but the helper can
> also be used to perform a lookup from output perspective (i.e., with
> BPF_FIB_LOOKUP_OUTPUT). In this case, passing IPv6 link-local addresses
> should be allowed and one legitimate use case is having the helper
> resolve the destination MAC for such packets.
> 
> Therefore, relax the limitation and allow IPv6 link-local addresses when
> the BPF_FIB_LOOKUP_OUTPUT flag is used.
> 
> Reviewed-by: Petr Machata <petrm@nvidia.com>
> Signed-off-by: Ido Schimmel <idosch@nvidia.com>
> ---
>  net/core/filter.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/net/core/filter.c b/net/core/filter.c
> index e92552b139b1..8f0d2aeffc3d 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -6241,8 +6241,15 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
>  	u32 mtu = 0;
>  
>  	/* link local addresses are never forwarded */
> -	if (rt6_need_strict(dst) || rt6_need_strict(src))
> -		return BPF_FIB_LKUP_RET_NOT_FWDED;
> +	if (rt6_need_strict(dst) || rt6_need_strict(src)) {
> +		int rej_type = IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK;
> +
> +		if (!(flags & BPF_FIB_LOOKUP_OUTPUT))
> +			return BPF_FIB_LKUP_RET_NOT_FWDED;
> +		if ((ipv6_addr_type(dst) & rej_type) ||
> +		    (ipv6_addr_type(src) & rej_type))
> +			return BPF_FIB_LKUP_RET_NOT_FWDED;
> +	}
>  
>  	dev = dev_get_by_index_rcu(net, params->ifindex);
>  	if (unlikely(!dev))

Reviewed-by: David Ahern <dsahern@kernel.org>