summaryrefslogtreecommitdiff
path: root/lib/locking-selftest.c
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2013-05-17 07:56:10 +0400
committerPablo Neira Ayuso <pablo@netfilter.org>2013-05-23 13:58:55 +0400
commit2a7851bffb008ff4882eee673da74718997b4265 (patch)
tree262c2fc71bd91eabf6bd947944d2050ff1cec923 /lib/locking-selftest.c
parent497574c72c9922cf20c12aed15313c389f722fa0 (diff)
downloadlinux-2a7851bffb008ff4882eee673da74718997b4265.tar.xz
netfilter: add nf_ipv6_ops hook to fix xt_addrtype with IPv6
Quoting https://bugzilla.netfilter.org/show_bug.cgi?id=812: [ ip6tables -m addrtype ] When I tried to use in the nat/PREROUTING it messes up the routing cache even if the rule didn't matched at all. [..] If I remove the --limit-iface-in from the non-working scenario, so just use the -m addrtype --dst-type LOCAL it works! This happens when LOCAL type matching is requested with --limit-iface-in, and the default ipv6 route is via the interface the packet we test arrived on. Because xt_addrtype uses ip6_route_output, the ipv6 routing implementation creates an unwanted cached entry, and the packet won't make it to the real/expected destination. Silently ignoring --limit-iface-in makes the routing work but it breaks rule matching (--dst-type LOCAL with limit-iface-in is supposed to only match if the dst address is configured on the incoming interface; without --limit-iface-in it will match if the address is reachable via lo). The test should call ipv6_chk_addr() instead. However, this would add a link-time dependency on ipv6. There are two possible solutions: 1) Revert the commit that moved ipt_addrtype to xt_addrtype, and put ipv6 specific code into ip6t_addrtype. 2) add new "nf_ipv6_ops" struct to register pointers to ipv6 functions. While the former might seem preferable, Pablo pointed out that there are more xt modules with link-time dependeny issues regarding ipv6, so lets go for 2). Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'lib/locking-selftest.c')
0 files changed, 0 insertions, 0 deletions