Skip to content
Commit cede24d1 authored by Vincent Bernat's avatar Vincent Bernat Committed by Pablo Neira Ayuso
Browse files

netfilter: ip6t_rpfilter: provide input interface for route lookup



In commit 47b7e7f8, this bit was removed at the same time the
RT6_LOOKUP_F_IFACE flag was removed. However, it is needed when
link-local addresses are used, which is a very common case: when
packets are routed, neighbor solicitations are done using link-local
addresses. For example, the following neighbor solicitation is not
matched by "-m rpfilter":

    IP6 fe80::5254:33ff:fe00:1 > ff02::1:ff00:3: ICMP6, neighbor
    solicitation, who has 2001:db8::5254:33ff:fe00:3, length 32

Commit 47b7e7f8 doesn't quite explain why we shouldn't use
RT6_LOOKUP_F_IFACE in the rpfilter case. I suppose the interface check
later in the function would make it redundant. However, the remaining
of the routing code is using RT6_LOOKUP_F_IFACE when there is no
source address (which matches rpfilter's case with a non-unicast
destination, like with neighbor solicitation).

Signed-off-by: default avatarVincent Bernat <vincent@bernat.im>
Fixes: 47b7e7f8 ("netfilter: don't set F_IFACE on ipv6 fib lookups")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 8d8540c4
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment