• David Ahern's avatar
    net/ipv6: Fix route leaking between VRFs · b6cdbc85
    David Ahern authored
    Donald reported that IPv6 route leaking between VRFs is not working.
    The root cause is the strict argument in the call to rt6_lookup when
    validating the nexthop spec.
    
    ip6_route_check_nh validates the gateway and device (if given) of a
    route spec. It in turn could call rt6_lookup (e.g., lookup in a given
    table did not succeed so it falls back to a full lookup) and if so
    sets the strict argument to 1. That means if the egress device is given,
    the route lookup needs to return a result with the same device. This
    strict requirement does not work with VRFs (IPv4 or IPv6) because the
    oif in the flow struct is overridden with the index of the VRF device
    to trigger a match on the l3mdev rule and force the lookup to its table.
    
    The right long term solution is to add an l3mdev index to the flow
    struct such that the oif is not overridden. That solution will not
    backport well, so this patch aims for a simpler solution to relax the
    strict argument if the route spec device is an l3mdev slave. As done
    in other places, use the FLOWI_FLAG_SKIP_NH_OIF to know that the
    RT6_LOOKUP_F_IFACE flag needs to be removed.
    
    Fixes: ca254490 ("net: Add VRF support to IPv6 stack")
    Reported-by: default avatarDonald Sharp <sharpd@cumulusnetworks.com>
    Signed-off-by: default avatarDavid Ahern <dsahern@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    b6cdbc85
route.c 125 KB