netfilter: rpfilter/fib: Populate flowic_l3mdev field

Use the introduced field for correct operation with VRF devices instead
of conditionally overwriting flowic_oif. This is a partial revert of
commit 07980f538cd5d ("netfilter: Fix rpfilter dropping vrf packets by
mistake"), implementing a simpler solution.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
index 8183bbcabb4af51b14e6e9053cf8ee8cd5ec8f36..ff85db52b2e56ecef625511ad51b6bf9b866c341 100644 (file)
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -77,7 +77,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
        flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
        flow.flowi4_tos = iph->tos & IPTOS_RT_MASK;
        flow.flowi4_scope = RT_SCOPE_UNIVERSE;
-       flow.flowi4_oif = l3mdev_master_ifindex_rcu(xt_in(par));
+       flow.flowi4_l3mdev = l3mdev_master_ifindex_rcu(xt_in(par));
 
        return rpfilter_lookup_reverse(xt_net(par), &flow, xt_in(par), info->flags) ^ invert;
 }

diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c
index 7ade04ff972d79b7030cc78c94a3847f9a27eff4..e886147eed11d22992525b0c1a41ae6532daa631 100644 (file)
--- a/net/ipv4/netfilter/nft_fib_ipv4.c
+++ b/net/ipv4/netfilter/nft_fib_ipv4.c
@@ -84,7 +84,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
                oif = NULL;
 
        if (priv->flags & NFTA_FIB_F_IIF)
-               fl4.flowi4_oif = l3mdev_master_ifindex_rcu(oif);
+               fl4.flowi4_l3mdev = l3mdev_master_ifindex_rcu(oif);
 
        if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&
            nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {

diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index d800801a5dd27ca0527fb8b9008595813c06338a..69d86b040a6afe649f3c5d9e2bca235e95a689db 100644 (file)
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -37,6 +37,7 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
        bool ret = false;
        struct flowi6 fl6 = {
                .flowi6_iif = LOOPBACK_IFINDEX,
+               .flowi6_l3mdev = l3mdev_master_ifindex_rcu(dev),
                .flowlabel = (* (__be32 *) iph) & IPV6_FLOWINFO_MASK,
                .flowi6_proto = iph->nexthdr,
                .daddr = iph->saddr,
@@ -55,9 +56,7 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
        if (rpfilter_addr_linklocal(&iph->saddr)) {
                lookup_flags |= RT6_LOOKUP_F_IFACE;
                fl6.flowi6_oif = dev->ifindex;
-       /* Set flowi6_oif for vrf devices to lookup route in l3mdev domain. */
-       } else if (netif_is_l3_master(dev) || netif_is_l3_slave(dev) ||
-                 (flags & XT_RPFILTER_LOOSE) == 0)
+       } else if ((flags & XT_RPFILTER_LOOSE) == 0)
                fl6.flowi6_oif = dev->ifindex;
 
        rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags);
@@ -72,9 +71,7 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
                goto out;
        }
 
-       if (rt->rt6i_idev->dev == dev ||
-           l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) == dev->ifindex ||
-           (flags & XT_RPFILTER_LOOSE))
+       if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE))
                ret = true;
  out:
        ip6_rt_put(rt);

diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
index 1d7e520d9966c70e50575ec3cc5270a97f7ea665..91faac610e03dbdc659202e0404177c242a3563b 100644 (file)
--- a/net/ipv6/netfilter/nft_fib_ipv6.c
+++ b/net/ipv6/netfilter/nft_fib_ipv6.c
@@ -41,9 +41,8 @@ static int nft_fib6_flowi_init(struct flowi6 *fl6, const struct nft_fib *priv,
        if (ipv6_addr_type(&fl6->daddr) & IPV6_ADDR_LINKLOCAL) {
                lookup_flags |= RT6_LOOKUP_F_IFACE;
                fl6->flowi6_oif = get_ifindex(dev ? dev : pkt->skb->dev);
-       } else if ((priv->flags & NFTA_FIB_F_IIF) &&
-                  (netif_is_l3_master(dev) || netif_is_l3_slave(dev))) {
-               fl6->flowi6_oif = dev->ifindex;
+       } else if (priv->flags & NFTA_FIB_F_IIF) {
+               fl6->flowi6_l3mdev = l3mdev_master_ifindex_rcu(dev);
        }
 
        if (ipv6_addr_type(&fl6->saddr) & IPV6_ADDR_UNICAST)