On Mon, Jan 21, 2019 at 11:45 AM Eli Cooper <elicooper@xxxxxxx> wrote:
>
> Commit 508b09046c0f ("netfilter: ipv6: Preserve link scope traffic
> original oif") made ip6_route_me_harder() keep the original oif for
> link-local and multicast packets. However, it also affected packets
> for the loopback address because it used rt6_need_strict().
>
> REDIRECT rules in the OUTPUT chain rewrite the destination to loopback
> address; thus its oif should not be preserved. This commit fixes the bug
> that redirected local packets are being dropped.
In your scenario iph->daddr was already set by REDIRECT to ::1,
wouldn't oif remain set to loopback interface regardless of what
implementation you choose for ip6_route_me_harder?
>
> Fixes: 508b09046c0f ("netfilter: ipv6: Preserve link scope traffic original oif")
> Signed-off-by: Eli Cooper <elicooper@xxxxxxx>
> ---
> net/ipv6/netfilter.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
> index 8b075f0..6d0b1f3 100644
> --- a/net/ipv6/netfilter.c
> +++ b/net/ipv6/netfilter.c
> @@ -23,9 +23,11 @@ int (struct net *net, struct sk_buff *skb)
> struct sock *sk = sk_to_full_sk(skb->sk);
> unsigned int hh_len;
> struct dst_entry *dst;
> + int strict = (ipv6_addr_type(&iph->daddr) &
> + (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL));
> struct flowi6 fl6 = {
> .flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if :
> - rt6_need_strict(&iph->daddr) ? skb_dst(skb)->dev->ifindex : 0,
> + strict ? skb_dst(skb)->dev->ifindex : 0,
> .flowi6_mark = skb->mark,
> .flowi6_uid = sock_net_uid(net, sk),
> .daddr = iph->daddr,
> --
> 2.7.4
>
