[RFC PATCH bpf-next 6/9] bpf: fib_lookup: Honor oif in IPv6 output route lookups
From: Ido Schimmel <idosch@nvidia.com>
Date: 2026-02-26 08:01:40
Also in:
bpf
Subsystem:
bpf [general] (safe dynamic programs and tools), bpf [networking] (tcx & tc bpf, sock_addr), networking [general], the rest · Maintainers:
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Currently, output route lookups behave differently between IPv4 and IPv6 when performed via the bpf_fib_lookup() helper with the BPF_FIB_LOOKUP_OUTPUT flag. IPv4 honors the oif and resolves the most specific route whose nexthop device matches the oif. If no such route exists, an error is returned. On the other hand, IPv6 simply resolves the most specific route, even if its nexthop device does not match the specified oif. Fix this by setting the RT6_LOOKUP_F_IFACE flag when performing an output route lookup, so that a device mismatch will be considered a fatal error. Reviewed-by: Petr Machata <petrm@nvidia.com> Signed-off-by: Ido Schimmel <idosch@nvidia.com> --- net/core/filter.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/net/core/filter.c b/net/core/filter.c
index 0d5d5a17acb2..e92552b139b1 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c@@ -6255,6 +6255,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params, if (flags & BPF_FIB_LOOKUP_OUTPUT) { fl6.flowi6_iif = 1; oif = fl6.flowi6_oif = params->ifindex; + strict = RT6_LOOKUP_F_IFACE; } else { oif = fl6.flowi6_iif = params->ifindex; fl6.flowi6_oif = 0;
--
2.53.0