diff options
| author |   Phil Sutter <phil@nwl.cc> | 2022-09-21 13:07:31 +0200 |
|---|---|---|
| committer |   Florian Westphal <fw@strlen.de> | 2022-09-28 13:33:26 +0200 |
| commit | 2a8a7c0eaa8747c16aa4a48d573aa920d5c00a5c (patch) | |
| tree | 8342309a2e62602b9e317ee5baebd06902cb3d9e /net/ipv4 | |
| parent | Merge branch 'sfc-tc-offload' (diff) | |
| download | linux-dev-2a8a7c0eaa8747c16aa4a48d573aa920d5c00a5c.tar.xz linux-dev-2a8a7c0eaa8747c16aa4a48d573aa920d5c00a5c.zip | |
netfilter: nft_fib: Fix for rpath check with VRF devices
Analogous to commit b575b24b8eee3 ("netfilter: Fix rpfilter
dropping vrf packets by mistake") but for nftables fib expression:
Add special treatment of VRF devices so that typical reverse path
filtering via 'fib saddr . iif oif' expression works as expected.
Fixes: f6d0cbcf09c50 ("netfilter: nf_tables: add fib expression")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'net/ipv4')
| -rw-r--r-- | net/ipv4/netfilter/nft_fib_ipv4.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c index b75cac69bd7e..7ade04ff972d 100644 --- a/net/ipv4/netfilter/nft_fib_ipv4.c +++ b/net/ipv4/netfilter/nft_fib_ipv4.c @@ -83,6 +83,9 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, else oif = NULL; + if (priv->flags & NFTA_FIB_F_IIF) + fl4.flowi4_oif = l3mdev_master_ifindex_rcu(oif); + if (nft_hook(pkt) == NF_INET_PRE_ROUTING && nft_fib_is_loopback(pkt->skb, nft_in(pkt))) { nft_fib_store_result(dest, priv, nft_in(pkt)); |