netfilter: don't set F_IFACE on ipv6 fib lookups

"fib" starts to behave strangely when an ipv6 default route is
added - the FIB lookup returns a route using 'oif' in this case.

This behaviour was inherited from ip6tables rpfilter so change
this as well.

Bugzilla: https://bugzilla.netfilter.org/show_bug.cgi?id=1221
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index 94deb69bbbdaaa34ca14dcaab943233d0a58a8a6..91ed25a24b79fde5f97999703b4699f84b2198b3 100644 (file)
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -48,10 +48,6 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
        }
 
        fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
-       if ((flags & XT_RPFILTER_LOOSE) == 0) {
-               fl6.flowi6_oif = dev->ifindex;
-               lookup_flags |= RT6_LOOKUP_F_IFACE;
-       }
 
        rt = (void *) ip6_route_lookup(net, &fl6, lookup_flags);
        if (rt->dst.error)

diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
index cc5174c7254c5697fc5bcd66ffeecb00e408e28e..62fc84d7bdff0b91eccce94aaebc8a13c77f31d0 100644 (file)
--- a/net/ipv6/netfilter/nft_fib_ipv6.c
+++ b/net/ipv6/netfilter/nft_fib_ipv6.c
@@ -180,7 +180,6 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
        }
 
        *dest = 0;
- again:
        rt = (void *)ip6_route_lookup(nft_net(pkt), &fl6, lookup_flags);
        if (rt->dst.error)
                goto put_rt_err;
@@ -189,15 +188,8 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
        if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL))
                goto put_rt_err;
 
-       if (oif && oif != rt->rt6i_idev->dev) {
-               /* multipath route? Try again with F_IFACE */
-               if ((lookup_flags & RT6_LOOKUP_F_IFACE) == 0) {
-                       lookup_flags |= RT6_LOOKUP_F_IFACE;
-                       fl6.flowi6_oif = oif->ifindex;
-                       ip6_rt_put(rt);
-                       goto again;
-               }
-       }
+       if (oif && oif != rt->rt6i_idev->dev)
+               goto put_rt_err;
 
        switch (priv->result) {
        case NFT_FIB_RESULT_OIF: