Vincent Bernat 5acd64888e netfilter: ip6t_rpfilter: provide input interface for route lookup ...

commit cede24d1b2 upstream.

In commit 47b7e7f828, this bit was removed at the same time the
RT6_LOOKUP_F_IFACE flag was removed. However, it is needed when
link-local addresses are used, which is a very common case: when
packets are routed, neighbor solicitations are done using link-local
addresses. For example, the following neighbor solicitation is not
matched by "-m rpfilter":

    IP6 fe80::5254:33ff:fe00:1 > ff02::1:ff00:3: ICMP6, neighbor
    solicitation, who has 2001:db8::5254:33ff:fe00:3, length 32

Commit 47b7e7f828 doesn't quite explain why we shouldn't use
RT6_LOOKUP_F_IFACE in the rpfilter case. I suppose the interface check
later in the function would make it redundant. However, the remaining
of the routing code is using RT6_LOOKUP_F_IFACE when there is no
source address (which matches rpfilter's case with a non-unicast
destination, like with neighbor solicitation).

Signed-off-by: Vincent Bernat <vincent@bernat.im>
Fixes: 47b7e7f828 ("netfilter: don't set F_IFACE on ipv6 fib lookups")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-07-08 15:30:50 +02:00

..

ip6_tables.c

netfilter: compat: prepare xt_compat_init_offsets to return errors

2018-04-26 11:02:21 +02:00

ip6t_ah.c

netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()

2012-05-09 12:53:47 +02:00

ip6t_eui64.c

netfilter: xtables: change hotdrop pointer to direct modification

2010-05-11 18:35:27 +02:00

ip6t_frag.c

netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()

2012-05-09 12:53:47 +02:00

ip6t_hbh.c

netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()

2012-05-09 12:53:47 +02:00

ip6t_ipv6header.c

netfilter: remove unnecessary break after return

2014-07-15 16:27:00 -07:00

ip6t_MASQUERADE.c

netfilter: x_tables: move hook state into xt_action_param structure

2016-11-03 10:56:21 +01:00

ip6t_mh.c

netfilter: xtables: change hotdrop pointer to direct modification

2010-05-11 18:35:27 +02:00

ip6t_NPT.c

xtables: extend matches and targets with .usersize

2017-01-09 17:24:55 +01:00

ip6t_REJECT.c

netfilter: x_tables: move hook state into xt_action_param structure

2016-11-03 10:56:21 +01:00

ip6t_rpfilter.c

netfilter: ip6t_rpfilter: provide input interface for route lookup

2018-07-08 15:30:50 +02:00

ip6t_rt.c

netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()

2012-05-09 12:53:47 +02:00

ip6t_SYNPROXY.c

netfilter: SYNPROXY: skip non-tcp packet in {ipv4, ipv6}_synproxy_hook

2017-10-09 13:08:39 +02:00

ip6table_filter.c

netfilter: xtables: don't hook tables by default

2016-03-02 20:05:24 +01:00

ip6table_mangle.c

netfilter: x_tables: simplify ip{6}table_mangle_hook()

2016-07-01 16:37:02 +02:00

ip6table_nat.c

netfilter: nf_hook_ops structs can be const

2017-07-31 19:10:44 +02:00

ip6table_raw.c

netfilter: xtables: don't hook tables by default

2016-03-02 20:05:24 +01:00

ip6table_security.c

netfilter: xtables: don't hook tables by default

2016-03-02 20:05:24 +01:00

Kconfig

netfilter: nf_tables: NAT chain and extensions require NF_TABLES

2018-06-21 04:02:43 +09:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nf_conntrack_l3proto_ipv6.c

netfilter: on sockopt() acquire sock lock only in the required scope

2018-02-25 11:07:50 +01:00

nf_conntrack_proto_icmpv6.c

net: Replace NF_CT_ASSERT() with WARN_ON().

2017-09-04 13:25:19 +02:00

nf_conntrack_reasm.c

netfilter: ipv6: nf_defrag: Kill frag queue on RFC2460 failure

2018-04-26 11:02:16 +02:00

nf_defrag_ipv6_hooks.c

netfilter: nf_hook_ops structs can be const

2017-07-31 19:10:44 +02:00

nf_dup_ipv6.c

netfilter: kill the fake untracked conntrack objects

2017-04-15 11:47:57 +02:00

nf_log_ipv6.c

netfilter: constify nf_loginfo structures

2017-08-02 14:25:59 +02:00

nf_nat_l3proto_ipv6.c

netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt

2018-03-15 10:54:24 +01:00

nf_nat_masquerade_ipv6.c

net: Replace NF_CT_ASSERT() with WARN_ON().

2017-09-04 13:25:19 +02:00

nf_nat_proto_icmpv6.c

net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool

2015-08-17 21:33:06 -07:00

nf_reject_ipv6.c

networking: make skb_put & friends return void pointers

2017-06-16 11:48:39 -04:00

nf_socket_ipv6.c

netfilter: nf_socket: Fix out of bounds access in nf_sk_lookup_slow_v{4,6}

2018-05-22 18:53:58 +02:00

nf_tables_ipv6.c

netfilter: Add the missed return value check of nft_register_chain_type

2016-09-12 19:54:45 +02:00

nft_chain_nat_ipv6.c

netfilter: Pass priv instead of nf_hook_ops to netfilter hooks

2015-09-18 22:00:16 +02:00

nft_chain_route_ipv6.c

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2016-09-25 23:34:19 +02:00

nft_dup_ipv6.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2016-11-15 10:54:36 -05:00

nft_fib_ipv6.c

netfilter: don't set F_IFACE on ipv6 fib lookups

2018-07-08 15:30:50 +02:00

nft_masq_ipv6.c

netfilter: nf_tables: fix mismatch in big-endian system

2017-03-13 13:30:28 +01:00

nft_redir_ipv6.c

netfilter: nf_tables: fix mismatch in big-endian system

2017-03-13 13:30:28 +01:00

nft_reject_ipv6.c

netfilter: nf_tables: use hook state from xt_action_param structure

2016-11-03 11:52:34 +01:00