netfilter: Update ip6_route_me_harder to consider L3 domain
The commit referenced below fixed packet re-routing if Netfilter mangles
a routing key property of a packet and the packet is routed in a VRF L3
domain. The fix, however, addressed IPv4 re-routing, only.
This commit applies the same behavior for IPv6. While at it, untangle
the nested ternary operator to make the code more readable.
Fixes: 6d8b49c3a3
("netfilter: Update ip_route_me_harder to consider L3 domain")
Cc: stable@vger.kernel.org
Signed-off-by: Martin Willi <martin@strongswan.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Родитель
b9b1e0da58
Коммит
8ddffdb944
|
@ -24,14 +24,13 @@ int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff
|
|||
{
|
||||
const struct ipv6hdr *iph = ipv6_hdr(skb);
|
||||
struct sock *sk = sk_to_full_sk(sk_partial);
|
||||
struct net_device *dev = skb_dst(skb)->dev;
|
||||
struct flow_keys flkeys;
|
||||
unsigned int hh_len;
|
||||
struct dst_entry *dst;
|
||||
int strict = (ipv6_addr_type(&iph->daddr) &
|
||||
(IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL));
|
||||
struct flowi6 fl6 = {
|
||||
.flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if :
|
||||
strict ? skb_dst(skb)->dev->ifindex : 0,
|
||||
.flowi6_mark = skb->mark,
|
||||
.flowi6_uid = sock_net_uid(net, sk),
|
||||
.daddr = iph->daddr,
|
||||
|
@ -39,6 +38,13 @@ int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff
|
|||
};
|
||||
int err;
|
||||
|
||||
if (sk && sk->sk_bound_dev_if)
|
||||
fl6.flowi6_oif = sk->sk_bound_dev_if;
|
||||
else if (strict)
|
||||
fl6.flowi6_oif = dev->ifindex;
|
||||
else
|
||||
fl6.flowi6_oif = l3mdev_master_ifindex(dev);
|
||||
|
||||
fib6_rules_early_flow_dissect(net, skb, &fl6, &flkeys);
|
||||
dst = ip6_route_output(net, sk, &fl6);
|
||||
err = dst->error;
|
||||
|
|
Загрузка…
Ссылка в новой задаче