Roman Mamedov <rm@xxxxxxxxxxx> wrote: > I have a machine which is a DHCPv6 client on a PPPoE connection. It also has: > > sysctl -w net.netfilter.nf_conntrack_tcp_loose=0 > ip6tables -t raw -A PREROUTING ! -i lo -m rpfilter --invert -j DROP > > After commits: > > netfilter: don't set F_IFACE on ipv6 fib lookups > http://patchwork.ozlabs.org/patch/873574/ > > netfilter: ip6t_rpfilter: provide input interface for route lookup > https://patchwork.ozlabs.org/patch/919290/ > > ...the DHCPv6 client no longer sees any replies from the server. They are now > filtered out by rpfilter. Removing the ip6tables rule shown above, or rolling > back both of these commits, makes it all work fine again. > > From commit messages it doesn't appear like this would be a "by design" > behavior of these changes. > > I did not test if other kernel branches (4.17 et al) are affected, but if they > also have both of these, I guess they likely are. Safe bet. Does this patch fix the problem for you? diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c --- a/net/ipv6/netfilter/ip6t_rpfilter.c +++ b/net/ipv6/netfilter/ip6t_rpfilter.c @@ -26,6 +26,12 @@ static bool rpfilter_addr_unicast(const struct in6_addr *addr) return addr_type & IPV6_ADDR_UNICAST; } +static bool rpfilter_addr_linklocal(const struct in6_addr *addr) +{ + int addr_type = ipv6_addr_type(addr); + return addr_type & IPV6_ADDR_LINKLOCAL; +} + static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, const struct net_device *dev, u8 flags) { @@ -48,7 +54,11 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, } fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; - if ((flags & XT_RPFILTER_LOOSE) == 0) + + if (rpfilter_addr_linklocal(&iph->saddr)) { + lookup_flags |= RT6_LOOKUP_F_IFACE; + fl6.flowi6_oif = dev->ifindex; + } else if ((flags & XT_RPFILTER_LOOSE) == 0) fl6.flowi6_oif = dev->ifindex; rt = (void *) ip6_route_lookup(net, &fl6, lookup_flags); -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
