Skip to content

Commit 7303bc1

Browse files
jcfaraccojcfaracco
committed
Merge: When using podman/netavark with vrf interfaces the correct DNAT rules are not automatically applied
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1078 JIRA: https://issues.redhat.com/browse/RHEL-88574 * fc91d5e selftests: netfilter: nft_fib.sh: check lo packets bypass fib lookup * 839340f selftests: netfilter: nft_fib.sh: add 'type' mode tests * 9828704 selftests: netfilter: move fib vrf test to nft_fib.sh * 8b53f46 netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy * 9a11966 netfilter: nf_tables: nft_fib: consistent l3mdev handling * 996d62e selftests: netfilter: nft_fib.sh: add type and oif tests with and without VRFs Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> --- <small>Created 2025-06-23 10:18 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://issues.redhat.com/secure/CreateIssueDetails!init.jspa?pid=12334433&issuetype=1&priority=4&summary=backporter+webhook+issue&components=kernel-workflow+/+backporter)</small> Approved-by: Phil Sutter <psutter@redhat.com> Approved-by: Murphy Zhou <xzhou@redhat.com> Merged-by: Julio Faracco <jfaracco@redhat.com>
2 parents d71ac5c + b42fc02 commit 7303bc1

File tree

5 files changed

+652
-52
lines changed

5 files changed

+652
-52
lines changed

‎include/net/netfilter/nft_fib.h‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
#ifndef _NFT_FIB_H_
33
#define _NFT_FIB_H_
44

5+
#include <net/l3mdev.h>
56
#include <net/netfilter/nf_tables.h>
67

78
struct nft_fib {
@@ -39,6 +40,14 @@ static inline bool nft_fib_can_skip(const struct nft_pktinfo *pkt)
3940
return nft_fib_is_loopback(pkt->skb, indev);
4041
}
4142

43+
static inline int nft_fib_l3mdev_master_ifindex_rcu(const struct nft_pktinfo *pkt,
44+
const struct net_device *iif)
45+
{
46+
const struct net_device *dev = iif ? iif : pkt->skb->dev;
47+
48+
return l3mdev_master_ifindex_rcu(dev);
49+
}
50+
4251
int nft_fib_dump(struct sk_buff *skb, const struct nft_expr *expr, bool reset);
4352
int nft_fib_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
4453
const struct nlattr * const tb[]);

‎net/ipv4/netfilter/nft_fib_ipv4.c‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,12 @@ void nft_fib4_eval_type(const struct nft_expr *expr, struct nft_regs *regs,
4949
else
5050
addr = iph->saddr;
5151

52-
*dst = inet_dev_addr_type(nft_net(pkt), dev, addr);
52+
if (priv->flags & (NFTA_FIB_F_IIF | NFTA_FIB_F_OIF)) {
53+
*dst = inet_dev_addr_type(nft_net(pkt), dev, addr);
54+
return;
55+
}
56+
57+
*dst = inet_addr_type_dev_table(nft_net(pkt), pkt->skb->dev, addr);
5358
}
5459
EXPORT_SYMBOL_GPL(nft_fib4_eval_type);
5560

@@ -64,8 +69,8 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
6469
struct flowi4 fl4 = {
6570
.flowi4_scope = RT_SCOPE_UNIVERSE,
6671
.flowi4_iif = LOOPBACK_IFINDEX,
72+
.flowi4_proto = pkt->tprot,
6773
.flowi4_uid = sock_net_uid(nft_net(pkt), NULL),
68-
.flowi4_l3mdev = l3mdev_master_ifindex_rcu(nft_in(pkt)),
6974
};
7075
const struct net_device *oif;
7176
const struct net_device *found;
@@ -89,6 +94,8 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
8994
else
9095
oif = NULL;
9196

97+
fl4.flowi4_l3mdev = nft_fib_l3mdev_master_ifindex_rcu(pkt, oif);
98+
9299
iph = skb_header_pointer(pkt->skb, noff, sizeof(_iph), &_iph);
93100
if (!iph) {
94101
regs->verdict.code = NFT_BREAK;

‎net/ipv6/netfilter/nft_fib_ipv6.c‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ static int nft_fib6_flowi_init(struct flowi6 *fl6, const struct nft_fib *priv,
5050
fl6->flowi6_mark = pkt->skb->mark;
5151

5252
fl6->flowlabel = (*(__be32 *)iph) & IPV6_FLOWINFO_MASK;
53+
fl6->flowi6_l3mdev = nft_fib_l3mdev_master_ifindex_rcu(pkt, dev);
5354

5455
return lookup_flags;
5556
}
@@ -73,8 +74,6 @@ static u32 __nft_fib6_eval_type(const struct nft_fib *priv,
7374
else if (priv->flags & NFTA_FIB_F_OIF)
7475
dev = nft_out(pkt);
7576

76-
fl6.flowi6_l3mdev = l3mdev_master_ifindex_rcu(dev);
77-
7877
nft_fib6_flowi_init(&fl6, priv, pkt, dev, iph);
7978

8079
if (dev && nf_ipv6_chk_addr(nft_net(pkt), &fl6.daddr, dev, true))
@@ -158,14 +157,14 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
158157
{
159158
const struct nft_fib *priv = nft_expr_priv(expr);
160159
int noff = skb_network_offset(pkt->skb);
160+
const struct net_device *found = NULL;
161161
const struct net_device *oif = NULL;
162162
u32 *dest = &regs->data[priv->dreg];
163163
struct ipv6hdr *iph, _iph;
164164
struct flowi6 fl6 = {
165165
.flowi6_iif = LOOPBACK_IFINDEX,
166166
.flowi6_proto = pkt->tprot,
167167
.flowi6_uid = sock_net_uid(nft_net(pkt), NULL),
168-
.flowi6_l3mdev = l3mdev_master_ifindex_rcu(nft_in(pkt)),
169168
};
170169
struct rt6_info *rt;
171170
int lookup_flags;
@@ -203,11 +202,15 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
203202
if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL))
204203
goto put_rt_err;
205204

206-
if (oif && oif != rt->rt6i_idev->dev &&
207-
l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) != oif->ifindex)
208-
goto put_rt_err;
205+
if (!oif) {
206+
found = rt->rt6i_idev->dev;
207+
} else {
208+
if (oif == rt->rt6i_idev->dev ||
209+
l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) == oif->ifindex)
210+
found = oif;
211+
}
209212

210-
nft_fib_store_result(dest, priv, rt->rt6i_idev->dev);
213+
nft_fib_store_result(dest, priv, found);
211214
put_rt_err:
212215
ip6_rt_put(rt);
213216
}

‎tools/testing/selftests/net/netfilter/conntrack_vrf.sh‎

Lines changed: 0 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ source lib.sh
3232

3333
IP0=172.30.30.1
3434
IP1=172.30.30.2
35-
DUMMYNET=10.9.9
3635
PFXL=30
3736
ret=0
3837

@@ -52,8 +51,6 @@ trap cleanup EXIT
5251

5352
setup_ns ns0 ns1
5453

55-
ip netns exec "$ns0" sysctl -q -w net.ipv4.conf.all.forwarding=1
56-
5754
if ! ip link add veth0 netns "$ns0" type veth peer name veth0 netns "$ns1" > /dev/null 2>&1; then
5855
echo "SKIP: Could not add veth device"
5956
exit $ksft_skip
@@ -64,18 +61,13 @@ if ! ip -net "$ns0" li add tvrf type vrf table 9876; then
6461
exit $ksft_skip
6562
fi
6663

67-
ip -net "$ns0" link add dummy0 type dummy
68-
6964
ip -net "$ns0" li set veth0 master tvrf
70-
ip -net "$ns0" li set dummy0 master tvrf
7165
ip -net "$ns0" li set tvrf up
7266
ip -net "$ns0" li set veth0 up
73-
ip -net "$ns0" li set dummy0 up
7467
ip -net "$ns1" li set veth0 up
7568

7669
ip -net "$ns0" addr add $IP0/$PFXL dev veth0
7770
ip -net "$ns1" addr add $IP1/$PFXL dev veth0
78-
ip -net "$ns0" addr add $DUMMYNET.1/$PFXL dev dummy0
7971

8072
listener_ready()
8173
{
@@ -216,35 +208,9 @@ EOF
216208
fi
217209
}
218210

219-
test_fib()
220-
{
221-
ip netns exec "$ns0" nft -f - <<EOF
222-
flush ruleset
223-
table ip t {
224-
counter fibcount { }
225-
226-
chain prerouting {
227-
type filter hook prerouting priority 0;
228-
meta iifname veth0 ip daddr $DUMMYNET.2 fib daddr oif dummy0 counter name fibcount notrack
229-
}
230-
}
231-
EOF
232-
ip -net "$ns1" route add 10.9.9.0/24 via "$IP0" dev veth0
233-
ip netns exec "$ns1" ping -q -w 1 -c 1 "$DUMMYNET".2 > /dev/null
234-
235-
if ip netns exec "$ns0" nft list counter t fibcount | grep -q "packets 1"; then
236-
echo "PASS: fib lookup returned exepected output interface"
237-
else
238-
echo "FAIL: fib lookup did not return exepected output interface"
239-
ret=1
240-
return
241-
fi
242-
}
243-
244211
test_ct_zone_in
245212
test_masquerade_vrf "default"
246213
test_masquerade_vrf "pfifo"
247214
test_masquerade_veth
248-
test_fib
249215

250216
exit $ret

0 commit comments

Comments
 (0)