]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: ipv6: Don't preserve original oif for loopback address
authorEli Cooper <elicooper@gmx.com>
Mon, 21 Jan 2019 10:45:27 +0000 (18:45 +0800)
committerPablo Neira Ayuso <pablo@netfilter.org>
Tue, 5 Feb 2019 13:10:33 +0000 (14:10 +0100)
commit689a610688fda7524fd3f6194a2e39b12d74e472
treea79acd81c09b6511c607b1696842c73dc2a70da5
parentb80da8170b36bed0144fa27a05b5a559ea4a7374
netfilter: ipv6: Don't preserve original oif for loopback address

Commit dcdcc74e0927 ("netfilter: ipv6: Preserve link scope traffic
original oif") made ip6_route_me_harder() keep the original oif for
link-local and multicast packets. However, it also affected packets
for the loopback address because it used rt6_need_strict().

REDIRECT rules in the OUTPUT chain rewrite the destination to loopback
address; thus its oif should not be preserved. This commit fixes the bug
that redirected local packets are being dropped. Actually the packet was
not exactly dropped; Instead it was sent out to the original oif rather
than lo. When a packet with daddr ::1 is sent to the router, it is
effectively dropped.

Fixes: dcdcc74e0927 ("netfilter: ipv6: Preserve link scope traffic original oif")
Signed-off-by: Eli Cooper <elicooper@gmx.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv6/netfilter.c