diff options
| author | Florian Westphal <fw@strlen.de> | 2021-06-08 14:48:18 +0300 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-06-09 22:11:03 +0300 |
| commit | 12f36e9bf678a81d030ca1b693dcda62b55af7c5 (patch) | |
| tree | dea414f65eea3dc6a33401d58fe449de87fbe0de /net/netfilter | |
| parent | 82944421243e5988898f54266687586ba07d889e (diff) | |
| download | linux-12f36e9bf678a81d030ca1b693dcda62b55af7c5.tar.xz | |
netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local
The ip6tables rpfilter match has an extra check to skip packets with
"::" source address.
Extend this to ipv6 fib expression. Else ipv6 duplicate address detection
packets will fail rpf route check -- lookup returns -ENETUNREACH.
While at it, extend the prerouting check to also cover the ingress hook.
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1543
Fixes: f6d0cbcf09c5 ("netfilter: nf_tables: add fib expression")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
0 files changed, 0 insertions, 0 deletions