From: linmiaohe <linmiaohe@huawei.com>
To: <pablo@netfilter.org>, <kadlec@blackhole.kfki.hu>, <fw@strlen.de>,
<davem@davemloft.net>, <kuznet@ms2.inr.ac.ru>,
<yoshfuji@linux-ipv6.org>, <netfilter-devel@vger.kernel.org>,
<coreteam@netfilter.org>, <netdev@vger.kernel.org>,
<linux-kernel@vger.kernel.org>
Cc: Mingfangsen <mingfangsen@huawei.com>
Subject: [PATCH v2] net: netfilter: Fix ipv6 rp_filter dropping vrf packets by mistake
Date: Wed, 24 Apr 2019 17:12:12 +0800 [thread overview]
Message-ID: <7662b7eb-89a4-adac-1e46-2c09816641f2@huawei.com> (raw)
From: Miaohe Lin <linmiaohe@huawei.com>
When firewall is enabled with rp_filter, vrf ipv6 packets
will be dropped because in device is vrf but out device
is an enslaved device. So rt->rt6i_idev->dev != dev and
maybe return false in func rpfilter_lookup_reverse6.
Here is the out message when I ping the peer:
ip vrf exec vrf1 ping 2013::2 -c 1
1 packets transmitted, 0 received, 100% packet loss, time 0ms
The drop info in /var/log/message:
Apr 24 14:59:45 localhost kernel: [81316.158259] rpfilter_DROP: IN=vrf1
OUT= MAC=52:54:00:9e:dd:c1:52:54:00:4f:81:38:86:dd
SRC=2013:0000:0000:0000:0000:0000:0000:0002
DST=2013:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=0 HOPLIMIT=64
FLOWLBL=1032942 PROTO=ICMPv6 TYPE=129 CODE=0 ID=14943 SEQ=1
Signed-off-by: linmiaohe <linmiaohe@huawei.com>
---
net/ipv6/netfilter/ip6t_rpfilter.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index c3c6b09acdc4..cf1070ab1252 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -73,6 +73,12 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
goto out;
}
+ if (netif_is_l3_master(dev)) {
+ dev = dev_get_by_index_rcu(dev_net(dev), IP6CB(skb)->iif);
+ if (!dev)
+ goto out;
+ }
+
if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE))
ret = true;
out:
--
2.19.1
next reply other threads:[~2019-04-24 9:12 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-24 9:12 linmiaohe [this message]
2019-04-24 15:24 ` [PATCH v2] net: netfilter: Fix ipv6 rp_filter dropping vrf packets by mistake David Ahern
2019-04-25 7:21 ` linmiaohe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7662b7eb-89a4-adac-1e46-2c09816641f2@huawei.com \
--to=linmiaohe@huawei.com \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=fw@strlen.de \
--cc=kadlec@blackhole.kfki.hu \
--cc=kuznet@ms2.inr.ac.ru \
--cc=linux-kernel@vger.kernel.org \
--cc=mingfangsen@huawei.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).