]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: ipv6: Don't preserve original oif for loopback address
authorEli Cooper <elicooper@gmx.com>
Mon, 21 Jan 2019 10:45:27 +0000 (18:45 +0800)
committerPablo Neira Ayuso <pablo@netfilter.org>
Tue, 5 Feb 2019 13:10:33 +0000 (14:10 +0100)
commit3268dc26f1c6fadf5b2d03cc59e6de45a6bd7fac
treea79acd81c09b6511c607b1696842c73dc2a70da5
parent6b588175055afff7b3caf93276e6abee3d3ba424
netfilter: ipv6: Don't preserve original oif for loopback address

Commit 56e406b99ee7 ("netfilter: ipv6: Preserve link scope traffic
original oif") made ip6_route_me_harder() keep the original oif for
link-local and multicast packets. However, it also affected packets
for the loopback address because it used rt6_need_strict().

REDIRECT rules in the OUTPUT chain rewrite the destination to loopback
address; thus its oif should not be preserved. This commit fixes the bug
that redirected local packets are being dropped. Actually the packet was
not exactly dropped; Instead it was sent out to the original oif rather
than lo. When a packet with daddr ::1 is sent to the router, it is
effectively dropped.

Fixes: 56e406b99ee7 ("netfilter: ipv6: Preserve link scope traffic original oif")
Signed-off-by: Eli Cooper <elicooper@gmx.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv6/netfilter.c