Thread (13 messages) 13 messages, 4 authors, 2012-12-06

Re: [PATCH] net: ICMPv6 packets transmitted on wrong interface if nfmark is mangled

From: Dries De Winter <hidden>
Date: 2012-11-30 12:29:20
Also in: netfilter-devel

2012/11/29 David Miller [off-list ref]:
From: Dries De Winter <redacted>
Date: Wed, 28 Nov 2012 10:09:55 +0100 (CET)
quoted
I propose a patch which allows to mark a dst_entry as "non-reroutable".
icmp6_dst_alloc() (used by ndisc and MLD implementation) will always mark
the
allocated dst_entry as such. A check is added to netfilter (IPv6-only) so
packets heading for a non-reroutable destination are never rerouted.
What about addrconf_dst_alloc()?  Shouldn't it have this new flag set
as well?
I don't think so. I'm not sure if I understand all of IPv6 routing
correctly, but it looks like dst entries allocated by
addrconf_dst_alloc() are added to the routing table pretty much like
normal routes and skbuffs get assigned such dst entries by normal rule
lookup / route lookup.

If an skbuff got assigned such a dst entry by normal routing in the
first place, and the changes done by the mangle table don't affect
routing (e.g. skb->mark changed but no policy based routing), I guess
that rerouting the packet will get you there too. In the meantime, by
not specifying DST_NOREROUTE for such destinations, you don't lose the
capability to mangle a packet so it should really be routed
differently.
Regardless of the answer to that question, it should be explained
in the commit message.
Should I post a new patch email including this comment?

Regards,

Dries.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help