Re: [PATCH] net: ICMPv6 packets transmitted on wrong interface if nfmark is mangled
From: Dries De Winter <hidden>
Date: 2012-11-30 12:29:20
Also in:
netfilter-devel
2012/11/29 David Miller [off-list ref]:
From: Dries De Winter <redacted> Date: Wed, 28 Nov 2012 10:09:55 +0100 (CET)quoted
I propose a patch which allows to mark a dst_entry as "non-reroutable". icmp6_dst_alloc() (used by ndisc and MLD implementation) will always mark the allocated dst_entry as such. A check is added to netfilter (IPv6-only) so packets heading for a non-reroutable destination are never rerouted.What about addrconf_dst_alloc()? Shouldn't it have this new flag set as well?
I don't think so. I'm not sure if I understand all of IPv6 routing correctly, but it looks like dst entries allocated by addrconf_dst_alloc() are added to the routing table pretty much like normal routes and skbuffs get assigned such dst entries by normal rule lookup / route lookup. If an skbuff got assigned such a dst entry by normal routing in the first place, and the changes done by the mangle table don't affect routing (e.g. skb->mark changed but no policy based routing), I guess that rerouting the packet will get you there too. In the meantime, by not specifying DST_NOREROUTE for such destinations, you don't lose the capability to mangle a packet so it should really be routed differently.
Regardless of the answer to that question, it should be explained in the commit message.
Should I post a new patch email including this comment? Regards, Dries.