From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-eopbgr680126.outbound.protection.outlook.com ([40.107.68.126]:35647 "EHLO NAM04-BN3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727170AbeH3WGI (ORCPT ); Thu, 30 Aug 2018 18:06:08 -0400 From: Sasha Levin To: "stable@vger.kernel.org" CC: Florian Westphal , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH AUTOSEL 4.18 036/113] netfilter: ip6t_rpfilter: set F_IFACE for linklocal addresses Date: Thu, 30 Aug 2018 18:02:46 +0000 Message-ID: <20180830180050.35735-36-alexander.levin@microsoft.com> References: <20180830180050.35735-1-alexander.levin@microsoft.com> In-Reply-To: <20180830180050.35735-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Florian Westphal [ Upstream commit da786717e0894886301ed2536843c13f9e8fd53e ] Roman reports that DHCPv6 client no longer sees replies from server due to ip6tables -t raw -A PREROUTING -m rpfilter --invert -j DROP rule. We need to set the F_IFACE flag for linklocal addresses, they are scoped per-device. Fixes: 47b7e7f82802 ("netfilter: don't set F_IFACE on ipv6 fib lookups") Reported-by: Roman Mamedov Tested-by: Roman Mamedov Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/ipv6/netfilter/ip6t_rpfilter.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_r= pfilter.c index 0fe61ede77c6..c3c6b09acdc4 100644 --- a/net/ipv6/netfilter/ip6t_rpfilter.c +++ b/net/ipv6/netfilter/ip6t_rpfilter.c @@ -26,6 +26,12 @@ static bool rpfilter_addr_unicast(const struct in6_addr = *addr) return addr_type & IPV6_ADDR_UNICAST; } =20 +static bool rpfilter_addr_linklocal(const struct in6_addr *addr) +{ + int addr_type =3D ipv6_addr_type(addr); + return addr_type & IPV6_ADDR_LINKLOCAL; +} + static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff= *skb, const struct net_device *dev, u8 flags) { @@ -48,7 +54,11 @@ static bool rpfilter_lookup_reverse6(struct net *net, co= nst struct sk_buff *skb, } =20 fl6.flowi6_mark =3D flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; - if ((flags & XT_RPFILTER_LOOSE) =3D=3D 0) + + if (rpfilter_addr_linklocal(&iph->saddr)) { + lookup_flags |=3D RT6_LOOKUP_F_IFACE; + fl6.flowi6_oif =3D dev->ifindex; + } else if ((flags & XT_RPFILTER_LOOSE) =3D=3D 0) fl6.flowi6_oif =3D dev->ifindex; =20 rt =3D (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags); --=20 2.17.1