From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pablo Neira Ayuso Subject: Re: [PATCH net] netfilter: ipt_rpfilter: remove the nh_scope test in rpfilter_lookup_reverse Date: Mon, 12 Oct 2015 17:15:03 +0200 Message-ID: <20151012151503.GA11015@salvia> References: <20151006131022.GA25207@breakpoint.cc> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Xin Long , netfilter-devel@vger.kernel.org To: Florian Westphal Return-path: Received: from mail.us.es ([193.147.175.20]:51744 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751994AbbJLPPn (ORCPT ); Mon, 12 Oct 2015 11:15:43 -0400 Content-Disposition: inline In-Reply-To: <20151006131022.GA25207@breakpoint.cc> Sender: netfilter-devel-owner@vger.kernel.org List-ID: On Tue, Oct 06, 2015 at 03:10:22PM +0200, Florian Westphal wrote: > Xin Long wrote: > > --accept-local option works for res.type == RTN_LOCAL, which should be from > > the local table, but there, the fib_info's nh->nh_scope = RT_SCOPE_NOWHERE > > ( > RT_SCOPE_HOST). in fib_create_info(). > > > > if (cfg->fc_scope == RT_SCOPE_HOST) { > > > but in our rpfilter_lookup_reverse(): > > > > if (dev_match || flags & XT_RPFILTER_LOOSE) > > return FIB_RES_NH(res).nh_scope <= RT_SCOPE_HOST; > > > > if nh->nh_scope > RT_SCOPE_HOST, it will fail. --accept-local option will never > > be passed. > > > > it seems the test is bogus and can be removed to fix this issue. > > Yes, you might want to consider submitting a followup patch that cleans > up the ipv4 route handling against net-next tree. > > Acked-by: Florian Westphal Applied to nf, thanks.