netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy

[ Upstream commit 8b53f46eb430fe5b42d485873b85331d2de2c469 ]

With a VRF, ipv4 and ipv6 FIB expression behave differently.

   fib daddr . iif oif

Will return the input interface name for ipv4, but the real device
for ipv6.  Example:

If VRF device name is tvrf and real (incoming) device is veth0.
First round is ok, both ipv4 and ipv6 will yield 'veth0'.

But in the second round (incoming device will be set to "tvrf"), ipv4
will yield "tvrf" whereas ipv6 returns "veth0" for the second round too.

This makes ipv6 behave like ipv4.

A followup patch will add a test case for this, without this change
it will fail with:
  get element inet t fibif6iif { tvrf . dead:1::99 . tvrf }
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  FAIL: did not find tvrf . dead:1::99 . tvrf in fibif6iif

Alternatively we could either not do anything at all or change
ipv4 to also return the lower/real device, however, nft (userspace)
doc says "iif: if fib lookup provides a route then check its output
interface is identical to the packets input interface." which is what
the nft fib ipv4 behaviour is.

Fixes: f6d0cbcf09c5 ("netfilter: nf_tables: add fib expression")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
index c9f1634b3838aeff4cd5002545f4ac496ce0bdc6..a89ce0fbfe4b125c042e8d6b8624d0651cad776f 100644 (file)
--- a/net/ipv6/netfilter/nft_fib_ipv6.c
+++ b/net/ipv6/netfilter/nft_fib_ipv6.c
@@ -158,6 +158,7 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
 {
        const struct nft_fib *priv = nft_expr_priv(expr);
        int noff = skb_network_offset(pkt->skb);
+       const struct net_device *found = NULL;
        const struct net_device *oif = NULL;
        u32 *dest = &regs->data[priv->dreg];
        struct ipv6hdr *iph, _iph;
@@ -202,11 +203,15 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
        if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL))
                goto put_rt_err;
 
-       if (oif && oif != rt->rt6i_idev->dev &&
-           l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) != oif->ifindex)
-               goto put_rt_err;
+       if (!oif) {
+               found = rt->rt6i_idev->dev;
+       } else {
+               if (oif == rt->rt6i_idev->dev ||
+                   l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) == oif->ifindex)
+                       found = oif;
+       }
 
-       nft_fib_store_result(dest, priv, rt->rt6i_idev->dev);
+       nft_fib_store_result(dest, priv, found);
  put_rt_err:
        ip6_rt_put(rt);
 }