Skip to content

Commit 6f8f132

Browse files
Florian Westphalummakynes
authored andcommitted
netfilter: Use flowlabel flow key when re-routing mangled packets
'ip6 dscp set $v' in an nftables outpute route chain has no effect. While nftables does detect the dscp change and calls the reroute hook. But ip6_route_me_harder never sets the dscp/flowlabel: flowlabel/dsfield routing rules are ignored and no reroute takes place. Thanks to Yi Chen for an excellent reproducer script that I used to validate this change. Fixes: 1da177e ("Linux-2.6.12-rc2") Reported-by: Yi Chen <[email protected]> Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent 4e7aaa6 commit 6f8f132

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

net/ipv6/netfilter.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff
3636
.flowi6_uid = sock_net_uid(net, sk),
3737
.daddr = iph->daddr,
3838
.saddr = iph->saddr,
39+
.flowlabel = ip6_flowinfo(iph),
3940
};
4041
int err;
4142

0 commit comments

Comments
 (0)