diff options
| author | Phil Sutter <phil@nwl.cc> | 2023-02-16 17:05:36 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-02-22 00:22:20 +0100 |
| commit | efb056e5f1f0036179b2f92c1c15f5ea7a891d70 (patch) | |
| tree | 07f0bc8ec591633fabf795cfb4990f994c52e03c /net/ipv6 | |
| parent | e6d57e9ff0aec323717ee36fc9ea34ad89217151 (diff) | |
| download | lwn-efb056e5f1f0036179b2f92c1c15f5ea7a891d70.tar.gz lwn-efb056e5f1f0036179b2f92c1c15f5ea7a891d70.zip | |
netfilter: ip6t_rpfilter: Fix regression with VRF interfaces
When calling ip6_route_lookup() for the packet arriving on the VRF
interface, the result is always the real (slave) interface. Expect this
when validating the result.
Fixes: acc641ab95b66 ("netfilter: rpfilter/fib: Populate flowic_l3mdev field")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/netfilter/ip6t_rpfilter.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c index a01d9b842bd0..67c87a88cde4 100644 --- a/net/ipv6/netfilter/ip6t_rpfilter.c +++ b/net/ipv6/netfilter/ip6t_rpfilter.c @@ -72,7 +72,9 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, goto out; } - if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE)) + if (rt->rt6i_idev->dev == dev || + l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) == dev->ifindex || + (flags & XT_RPFILTER_LOOSE)) ret = true; out: ip6_rt_put(rt); |