kernel: preserve oif of IPv6 link scope packets

Backort upstream patch which preserves oif of IPv6 link scoped packets.
The outgoing interface of IPv6 link scope packets can be changed by the
function ip6_route_me_harder. This is unwanted behavior for link local
packets and multicast packets as the outgoing interface is fixed and must
not be altered as it can break neighbor discovery and multicast listener
discovery.

Signed-off-by: Hans Dedecker <[email protected]>

diff --git a/target/linux/generic/backport-4.14/096-v4.20-netfilter-ipv6-Preserve-link-scope-traffic-original-.patch b/target/linux/generic/backport-4.14/096-v4.20-netfilter-ipv6-Preserve-link-scope-traffic-original-.patch
new file mode 100644 (file)
index 0000000..1eb23af
--- /dev/null
+++ b/target/linux/generic/backport-4.14/096-v4.20-netfilter-ipv6-Preserve-link-scope-traffic-original-.patch
@@ -0,0 +1,32 @@
+From 508b09046c0f21678652fb66fd1e9959d55591d2 Mon Sep 17 00:00:00 2001
+From: Alin Nastac <[email protected]>
+Date: Wed, 21 Nov 2018 14:00:30 +0100
+Subject: [PATCH] netfilter: ipv6: Preserve link scope traffic original oif
+
+When ip6_route_me_harder is invoked, it resets outgoing interface of:
+  - link-local scoped packets sent by neighbor discovery
+  - multicast packets sent by MLD host
+  - multicast packets send by MLD proxy daemon that sets outgoing
+    interface through IPV6_PKTINFO ipi6_ifindex
+
+Link-local and multicast packets must keep their original oif after
+ip6_route_me_harder is called.
+
+Signed-off-by: Alin Nastac <[email protected]>
+Signed-off-by: Pablo Neira Ayuso <[email protected]>
+---
+ net/ipv6/netfilter.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -25,7 +25,8 @@ int ip6_route_me_harder(struct net *net,
+       unsigned int hh_len;
+       struct dst_entry *dst;
+       struct flowi6 fl6 = {
+-              .flowi6_oif = sk ? sk->sk_bound_dev_if : 0,
++              .flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if :
++                      rt6_need_strict(&iph->daddr) ? skb_dst(skb)->dev->ifindex : 0,
+               .flowi6_mark = skb->mark,
+               .flowi6_uid = sock_net_uid(net, sk),
+               .daddr = iph->daddr,

diff --git a/target/linux/generic/backport-4.14/304-v4.16-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch b/target/linux/generic/backport-4.14/304-v4.16-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch
index 458ddd41723e3eb6b71522cf94c8d947c093f9ed..a73256a2c925bc03f509e625c59e391223a8bf8b 100644 (file)
--- a/target/linux/generic/backport-4.14/304-v4.16-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch
+++ b/target/linux/generic/backport-4.14/304-v4.16-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch
@@ -116,7 +116,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
        .saveroute              = nf_ip_saveroute,
 --- a/net/ipv6/netfilter.c
 +++ b/net/ipv6/netfilter.c
-@@ -193,12 +193,12 @@ static __sum16 nf_ip6_checksum_partial(s
+@@ -194,12 +194,12 @@ static __sum16 nf_ip6_checksum_partial(s
  static const struct nf_ipv6_ops ipv6ops = {
        .chk_addr       = ipv6_chk_addr,
        .route_input    = ip6_route_input,

diff --git a/target/linux/generic/backport-4.14/305-v4.16-netfilter-move-checksum_partial-indirection-to-struc.patch b/target/linux/generic/backport-4.14/305-v4.16-netfilter-move-checksum_partial-indirection-to-struc.patch
index 19a0aacb45be55b1b24b125abb09fc2db8a87439..6ef0928257bfc41c33dd34253e5aae8533dba190 100644 (file)
--- a/target/linux/generic/backport-4.14/305-v4.16-netfilter-move-checksum_partial-indirection-to-struc.patch
+++ b/target/linux/generic/backport-4.14/305-v4.16-netfilter-move-checksum_partial-indirection-to-struc.patch
@@ -151,7 +151,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
        .reroute                = nf_ip_reroute,
 --- a/net/ipv6/netfilter.c
 +++ b/net/ipv6/netfilter.c
-@@ -191,15 +191,15 @@ static __sum16 nf_ip6_checksum_partial(s
+@@ -192,15 +192,15 @@ static __sum16 nf_ip6_checksum_partial(s
  };
  
  static const struct nf_ipv6_ops ipv6ops = {

diff --git a/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch b/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
index 75de3c84fef7f6cae7b6e2514521a4d536791de1..2b44066f1aadae66b73ceb1415112d9764ee1bd4 100644 (file)
--- a/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
+++ b/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
@@ -125,7 +125,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
  };
 --- a/net/ipv6/netfilter.c
 +++ b/net/ipv6/netfilter.c
-@@ -69,31 +69,6 @@ int ip6_route_me_harder(struct net *net,
+@@ -70,31 +70,6 @@ int ip6_route_me_harder(struct net *net,
  }
  EXPORT_SYMBOL(ip6_route_me_harder);
  
@@ -157,7 +157,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
  static int nf_ip6_reroute(struct net *net, struct sk_buff *skb,
                          const struct nf_queue_entry *entry)
  {
-@@ -201,7 +176,6 @@ static const struct nf_ipv6_ops ipv6ops
+@@ -202,7 +177,6 @@ static const struct nf_ipv6_ops ipv6ops
  static const struct nf_afinfo nf_ip6_afinfo = {
        .family                 = AF_INET6,
        .route                  = nf_ip6_route,

diff --git a/target/linux/generic/backport-4.14/307-v4.16-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch b/target/linux/generic/backport-4.14/307-v4.16-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch
index b98aac0fff6533fd7a0b35ae32458d8dac014b5f..eb3e29349a3cd7533608fc4e560e7bd372e3b771 100644 (file)
--- a/target/linux/generic/backport-4.14/307-v4.16-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch
+++ b/target/linux/generic/backport-4.14/307-v4.16-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch
@@ -114,7 +114,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
  };
 --- a/net/ipv6/netfilter.c
 +++ b/net/ipv6/netfilter.c
-@@ -171,11 +171,11 @@ static const struct nf_ipv6_ops ipv6ops
+@@ -172,11 +172,11 @@ static const struct nf_ipv6_ops ipv6ops
        .fragment               = ip6_fragment,
        .checksum               = nf_ip6_checksum,
        .checksum_partial       = nf_ip6_checksum_partial,

diff --git a/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch b/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
index 5dbd1a4cea5bc4501d304e7a72d56d60fecd8249..d45c4ef85b6d6b18e3176d401eb110d2ab8b02df 100644 (file)
--- a/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
+++ b/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
@@ -138,7 +138,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
  
 --- a/net/ipv6/netfilter.c
 +++ b/net/ipv6/netfilter.c
-@@ -69,7 +69,7 @@ int ip6_route_me_harder(struct net *net,
+@@ -70,7 +70,7 @@ int ip6_route_me_harder(struct net *net,
  }
  EXPORT_SYMBOL(ip6_route_me_harder);
  
@@ -147,7 +147,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
                          const struct nf_queue_entry *entry)
  {
        struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
-@@ -79,7 +79,7 @@ static int nf_ip6_reroute(struct net *ne
+@@ -80,7 +80,7 @@ static int nf_ip6_reroute(struct net *ne
                if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
                    !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) ||
                    skb->mark != rt_info->mark)
@@ -156,7 +156,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
        }
        return 0;
  }
-@@ -172,11 +172,11 @@ static const struct nf_ipv6_ops ipv6ops
+@@ -173,11 +173,11 @@ static const struct nf_ipv6_ops ipv6ops
        .checksum               = nf_ip6_checksum,
        .checksum_partial       = nf_ip6_checksum_partial,
        .route                  = nf_ip6_route,

diff --git a/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch b/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
index 21381b7e6b5eec012299e049427e42c870df96ae..270379346a4502fc758ce6d2c7894f019c0b89b6 100644 (file)
--- a/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
+++ b/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
@@ -29,7 +29,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
  static int __init ipv4_netfilter_init(void)
 --- a/net/ipv6/netfilter.c
 +++ b/net/ipv6/netfilter.c
-@@ -177,7 +177,6 @@ static const struct nf_ipv6_ops ipv6ops
+@@ -178,7 +178,6 @@ static const struct nf_ipv6_ops ipv6ops
  
  static const struct nf_afinfo nf_ip6_afinfo = {
        .family                 = AF_INET6,

diff --git a/target/linux/generic/backport-4.14/310-v4.16-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch b/target/linux/generic/backport-4.14/310-v4.16-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch
index 0ca58f99885a3df27378a29229bc30d6abb94c12..381b99721a4991fff11bdc7602a2e10258f7f16a 100644 (file)
--- a/target/linux/generic/backport-4.14/310-v4.16-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch
+++ b/target/linux/generic/backport-4.14/310-v4.16-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch
@@ -102,7 +102,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
 -subsys_initcall(ipv4_netfilter_init);
 --- a/net/ipv6/netfilter.c
 +++ b/net/ipv6/netfilter.c
-@@ -175,14 +175,10 @@ static const struct nf_ipv6_ops ipv6ops
+@@ -176,14 +176,10 @@ static const struct nf_ipv6_ops ipv6ops
        .reroute                = nf_ip6_reroute,
  };
  
@@ -118,7 +118,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
  }
  
  /* This can be called from inet6_init() on errors, so it cannot
-@@ -191,5 +187,4 @@ int __init ipv6_netfilter_init(void)
+@@ -192,5 +188,4 @@ int __init ipv6_netfilter_init(void)
  void ipv6_netfilter_fini(void)
  {
        RCU_INIT_POINTER(nf_ipv6_ops, NULL);

diff --git a/target/linux/generic/backport-4.19/096-v4.20-netfilter-ipv6-Preserve-link-scope-traffic-original-.patch b/target/linux/generic/backport-4.19/096-v4.20-netfilter-ipv6-Preserve-link-scope-traffic-original-.patch
new file mode 100644 (file)
index 0000000..3f5267e
--- /dev/null
+++ b/target/linux/generic/backport-4.19/096-v4.20-netfilter-ipv6-Preserve-link-scope-traffic-original-.patch
@@ -0,0 +1,32 @@
+From 508b09046c0f21678652fb66fd1e9959d55591d2 Mon Sep 17 00:00:00 2001
+From: Alin Nastac <[email protected]>
+Date: Wed, 21 Nov 2018 14:00:30 +0100
+Subject: [PATCH] netfilter: ipv6: Preserve link scope traffic original oif
+
+When ip6_route_me_harder is invoked, it resets outgoing interface of:
+  - link-local scoped packets sent by neighbor discovery
+  - multicast packets sent by MLD host
+  - multicast packets send by MLD proxy daemon that sets outgoing
+    interface through IPV6_PKTINFO ipi6_ifindex
+
+Link-local and multicast packets must keep their original oif after
+ip6_route_me_harder is called.
+
+Signed-off-by: Alin Nastac <[email protected]>
+Signed-off-by: Pablo Neira Ayuso <[email protected]>
+---
+ net/ipv6/netfilter.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -24,7 +24,8 @@ int ip6_route_me_harder(struct net *net,
+       unsigned int hh_len;
+       struct dst_entry *dst;
+       struct flowi6 fl6 = {
+-              .flowi6_oif = sk ? sk->sk_bound_dev_if : 0,
++              .flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if :
++                      rt6_need_strict(&iph->daddr) ? skb_dst(skb)->dev->ifindex : 0,
+               .flowi6_mark = skb->mark,
+               .flowi6_uid = sock_net_uid(net, sk),
+               .daddr = iph->daddr,

diff --git a/target/linux/generic/backport-4.9/096-v4.20-netfilter-ipv6-Preserve-link-scope-traffic-original-.patch b/target/linux/generic/backport-4.9/096-v4.20-netfilter-ipv6-Preserve-link-scope-traffic-original-.patch
new file mode 100644 (file)
index 0000000..bfb7690
--- /dev/null
+++ b/target/linux/generic/backport-4.9/096-v4.20-netfilter-ipv6-Preserve-link-scope-traffic-original-.patch
@@ -0,0 +1,32 @@
+From 508b09046c0f21678652fb66fd1e9959d55591d2 Mon Sep 17 00:00:00 2001
+From: Alin Nastac <[email protected]>
+Date: Wed, 21 Nov 2018 14:00:30 +0100
+Subject: [PATCH] netfilter: ipv6: Preserve link scope traffic original oif
+
+When ip6_route_me_harder is invoked, it resets outgoing interface of:
+  - link-local scoped packets sent by neighbor discovery
+  - multicast packets sent by MLD host
+  - multicast packets send by MLD proxy daemon that sets outgoing
+    interface through IPV6_PKTINFO ipi6_ifindex
+
+Link-local and multicast packets must keep their original oif after
+ip6_route_me_harder is called.
+
+Signed-off-by: Alin Nastac <[email protected]>
+Signed-off-by: Pablo Neira Ayuso <[email protected]>
+---
+ net/ipv6/netfilter.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -24,7 +24,8 @@ int ip6_route_me_harder(struct net *net,
+       unsigned int hh_len;
+       struct dst_entry *dst;
+       struct flowi6 fl6 = {
+-              .flowi6_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
++              .flowi6_oif = skb->sk && skb->sk->sk_bound_dev_if ? skb->sk->sk_bound_dev_if :
++                      rt6_need_strict(&iph->daddr) ? skb_dst(skb)->dev->ifindex : 0,
+               .flowi6_mark = skb->mark,
+               .daddr = iph->daddr,
+               .saddr = iph->saddr,