Skip to content

Commit

Permalink
netfilter: Use flowlabel flow key when re-routing mangled packets
Browse files Browse the repository at this point in the history
'ip6 dscp set $v' in an nftables outpute route chain has no effect.
While nftables does detect the dscp change and calls the reroute hook.
But ip6_route_me_harder never sets the dscp/flowlabel:
flowlabel/dsfield routing rules are ignored and no reroute takes place.

Thanks to Yi Chen for an excellent reproducer script that I used
to validate this change.

Fixes: 1da177e ("Linux-2.6.12-rc2")
Reported-by: Yi Chen <[email protected]>
Signed-off-by: Florian Westphal <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>
  • Loading branch information
Florian Westphal authored and ummakynes committed Jun 11, 2024
1 parent 4e7aaa6 commit 6f8f132
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions net/ipv6/netfilter.c
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff
.flowi6_uid = sock_net_uid(net, sk),
.daddr = iph->daddr,
.saddr = iph->saddr,
.flowlabel = ip6_flowinfo(iph),
};
int err;

Expand Down

0 comments on commit 6f8f132

Please sign in to comment.