netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy

With a VRF, ipv4 and ipv6 FIB expression behave differently.

   fib daddr . iif oif

Will return the input interface name for ipv4, but the real device
for ipv6.  Example:

If VRF device name is tvrf and real (incoming) device is veth0.
First round is ok, both ipv4 and ipv6 will yield 'veth0'.

But in the second round (incoming device will be set to "tvrf"), ipv4
will yield "tvrf" whereas ipv6 returns "veth0" for the second round too.

This makes ipv6 behave like ipv4.

A followup patch will add a test case for this, without this change
it will fail with:
  get element inet t fibif6iif { tvrf . dead:1::99 . tvrf }
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  FAIL: did not find tvrf . dead:1::99 . tvrf in fibif6iif

Alternatively we could either not do anything at all or change
ipv4 to also return the lower/real device, however, nft (userspace)
doc says "iif: if fib lookup provides a route then check its output
interface is identical to the packets input interface." which is what
the nft fib ipv4 behaviour is.

Fixes: f6d0cbcf09c5 ("netfilter: nf_tables: add fib expression")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
index 7fd9d7b21cd42d1c756075cb5d1e9aab89ee3350..f1f5640da6728509e9544f15623dccc4d58d718b 100644 (file)
--- a/net/ipv6/netfilter/nft_fib_ipv6.c
+++ b/net/ipv6/netfilter/nft_fib_ipv6.c
@@ -158,6 +158,7 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
 {
        const struct nft_fib *priv = nft_expr_priv(expr);
        int noff = skb_network_offset(pkt->skb);
+       const struct net_device *found = NULL;
        const struct net_device *oif = NULL;
        u32 *dest = &regs->data[priv->dreg];
        struct ipv6hdr *iph, _iph;
@@ -203,11 +204,15 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
        if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL))
                goto put_rt_err;
 
-       if (oif && oif != rt->rt6i_idev->dev &&
-           l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) != oif->ifindex)
-               goto put_rt_err;
+       if (!oif) {
+               found = rt->rt6i_idev->dev;
+       } else {
+               if (oif == rt->rt6i_idev->dev ||
+                   l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) == oif->ifindex)
+                       found = oif;
+       }
 
-       nft_fib_store_result(dest, priv, rt->rt6i_idev->dev);
+       nft_fib_store_result(dest, priv, found);
  put_rt_err:
        ip6_rt_put(rt);
 }