Re: [PATCH v2 net] ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup

[David Ahern <dsahern@kernel.org>]

On 7/22/26 4:42 AM, Eric Dumazet wrote:
> When Linux forwards a packet and needs to generate an ICMP error,
> icmp_route_lookup() performs a reverse-path relookup. For non-local
> destinations, it performs a decoy lookup to find the expected egress
> interface (rt2->dst.dev) before validating the path with ip_route_input().
> 
> Currently, the decoy flow structure (fl4_2) only sets .daddr = fl4_dec.saddr,
> leaving .saddr, .flowi4_dscp, .flowi4_proto, .flowi4_mark, .flowi4_oif,
> .fl4_sport, .fl4_dport, and .flowi4_uid zeroed out.
> 
> When policy routing rules (such as ip rule add from $SRC lookup 100, or
> dscp/fwmark/ipproto/port rules, or VRF bindings) are configured:
> 1. The decoy lookup fails to match the policy rule because saddr and other
>    key flow selectors are missing in fl4_2.
> 2. It resolves a route using the default table instead, returning an incorrect
>    egress netdev.
> 3. Passing the wrong netdev to ip_route_input() causes strict reverse-path
>    filtering (rp_filter=1) to fail, logging false-positive "martian source"
>    warnings and causing the relookup to fail.
> 
> Fix this by initializing fl4_2 from fl4_dec and:
> - Swapping source/destination IP addresses.
> - Swapping L4 ports for transport protocols with ports (TCP, UDP, SCTP, DCCP)
>   so port-based policy routing matches correctly. Non-port protocols (such as
>   ICMP or GRE) leave the flowi_uli union fields intact to prevent corruption.
> - Setting .flowi4_oif = l3mdev_master_ifindex(route_lookup_dev) to ensure
>   VRF routing tables are respected.
> - Setting .flowi4_flags |= FLOWI_FLAG_ANYSRC to allow output route lookups
>   for non-local source IP addresses.
> - Using __ip_route_output_key() instead of ip_route_output_key() for fl4_2
>   so that raw FIB routing is used without triggering spurious XFRM policy
>   lookups on the decoy flow (the actual XFRM lookup is performed later using
>   fl4_dec).
> 
> Fixes: 415b3334a21a ("icmp: Fix regression in nexthop resolution during replies.")
> Reported-by: Muhammad Ziad <muhzi100@gmail.com>
> Closes: https://lore.kernel.org/netdev/CAOAwikA60AYKdFr_UDLyja3oU4hqyAE7uFZWqum5uRdaQsgRYg@mail.gmail.com/
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> v2: addressed Sashiko and Jakub feedback
> v1: https://lore.kernel.org/netdev/20260716021049.2124921-1-edumazet@google.com/
> 
>  net/ipv4/icmp.c | 18 +++++++++++++++---
>  1 file changed, 15 insertions(+), 3 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>