![Florian Westphal](/assets/img/avatar_default.png)
Quoting https://bugzilla.netfilter.org/show_bug.cgi?id=812: [ ip6tables -m addrtype ] When I tried to use in the nat/PREROUTING it messes up the routing cache even if the rule didn't matched at all. [..] If I remove the --limit-iface-in from the non-working scenario, so just use the -m addrtype --dst-type LOCAL it works! This happens when LOCAL type matching is requested with --limit-iface-in, and the default ipv6 route is via the interface the packet we test arrived on. Because xt_addrtype uses ip6_route_output, the ipv6 routing implementation creates an unwanted cached entry, and the packet won't make it to the real/expected destination. Silently ignoring --limit-iface-in makes the routing work but it breaks rule matching (--dst-type LOCAL with limit-iface-in is supposed to only match if the dst address is configured on the incoming interface; without --limit-iface-in it will match if the address is reachable via lo). The test should call ipv6_chk_addr() instead. However, this would add a link-time dependency on ipv6. There are two possible solutions: 1) Revert the commit that moved ipt_addrtype to xt_addrtype, and put ipv6 specific code into ip6t_addrtype. 2) add new "nf_ipv6_ops" struct to register pointers to ipv6 functions. While the former might seem preferable, Pablo pointed out that there are more xt modules with link-time dependeny issues regarding ipv6, so lets go for 2). Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
42 lines
1.2 KiB
C
42 lines
1.2 KiB
C
/* IPv6-specific defines for netfilter.
|
|
* (C)1998 Rusty Russell -- This code is GPL.
|
|
* (C)1999 David Jeffery
|
|
* this header was blatantly ripped from netfilter_ipv4.h
|
|
* it's amazing what adding a bunch of 6s can do =8^)
|
|
*/
|
|
#ifndef __LINUX_IP6_NETFILTER_H
|
|
#define __LINUX_IP6_NETFILTER_H
|
|
|
|
#include <uapi/linux/netfilter_ipv6.h>
|
|
|
|
|
|
#ifdef CONFIG_NETFILTER
|
|
extern int ip6_route_me_harder(struct sk_buff *skb);
|
|
extern __sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
|
|
unsigned int dataoff, u_int8_t protocol);
|
|
|
|
extern int ipv6_netfilter_init(void);
|
|
extern void ipv6_netfilter_fini(void);
|
|
|
|
/*
|
|
* Hook functions for ipv6 to allow xt_* modules to be built-in even
|
|
* if IPv6 is a module.
|
|
*/
|
|
struct nf_ipv6_ops {
|
|
int (*chk_addr)(struct net *net, const struct in6_addr *addr,
|
|
const struct net_device *dev, int strict);
|
|
};
|
|
|
|
extern const struct nf_ipv6_ops __rcu *nf_ipv6_ops;
|
|
static inline const struct nf_ipv6_ops *nf_get_ipv6_ops(void)
|
|
{
|
|
return rcu_dereference(nf_ipv6_ops);
|
|
}
|
|
|
|
#else /* CONFIG_NETFILTER */
|
|
static inline int ipv6_netfilter_init(void) { return 0; }
|
|
static inline void ipv6_netfilter_fini(void) { return; }
|
|
#endif /* CONFIG_NETFILTER */
|
|
|
|
#endif /*__LINUX_IP6_NETFILTER_H*/
|