From: Florian Westphal Date: Thu, 6 Jun 2024 10:23:31 +0000 (+0200) Subject: netfilter: Use flowlabel flow key when re-routing mangled packets X-Git-Tag: v6.10-rc4~26^2~8^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6f8f132cc7bac2ac76911e47d5baa378aafda4cb;p=thirdparty%2Flinux.git netfilter: Use flowlabel flow key when re-routing mangled packets 'ip6 dscp set $v' in an nftables outpute route chain has no effect. While nftables does detect the dscp change and calls the reroute hook. But ip6_route_me_harder never sets the dscp/flowlabel: flowlabel/dsfield routing rules are ignored and no reroute takes place. Thanks to Yi Chen for an excellent reproducer script that I used to validate this change. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Yi Chen Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c index 53d255838e6ab..5d989d803009f 100644 --- a/net/ipv6/netfilter.c +++ b/net/ipv6/netfilter.c @@ -36,6 +36,7 @@ int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff .flowi6_uid = sock_net_uid(net, sk), .daddr = iph->daddr, .saddr = iph->saddr, + .flowlabel = ip6_flowinfo(iph), }; int err;