Thanks David for the response.
Our local kernel doesn’t have vrf_ip6_out_direct patch. I will pick this change
from upstream to fix the firewall issue.
Thanks,
Preethi
On 03/12/20, 5:42 AM, "David Ahern" <dsah...@gmail.com> wrote:
[External Email. Be cautious of content]
On 12/2/20 4:31 AM, Preethi Ramachandra wrote:
> Hi David Ahren,
>
> In TCP egress path for ipv6 the device passed to NF_INET_LOCAL_OUT hook
should be skb_dst(skb)->dev instead of dst->dev.
>
>
https://urldefense.com/v3/__https://elixir.bootlin.com/linux/latest/source/net/ipv6/ip6_output.c*L202__;Iw!!NEt6yMaO-gk!TTEMIr6Y_qiOz_QY3_Fh4QnRglxHEfu1mwoSo_Sve_Q6rdpmCMaf3l8ZCBNAnN4W$
> struct dst_entry *dst = skb_dst(skb); >>> This may return slave device.
>
> In this code path the DST Dev and SKB DST Dev will be set to VRF master
device.
> ip6_xmit->l3mdev_ip6_out->vrf_l3_out->vrf_ip6_out (This will set SKB DST
Dev to vrf0)
>
> However, once the control passes back to ip6_xmit,
https://urldefense.com/v3/__https://elixir.bootlin.com/linux/latest/source/net/ipv6/ip6_output.c*L280__;Iw!!NEt6yMaO-gk!TTEMIr6Y_qiOz_QY3_Fh4QnRglxHEfu1mwoSo_Sve_Q6rdpmCMaf3l8ZCDcZbfyI$
> Slave device is passed to LOCAL_OUT nf_hook instead of skb_dst(skb)->dev.
>
> return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
> net, (struct sock *)sk, skb, NULL, dst->dev, <<<< Should be
skb_dst(skb)->dev
> dst_output);
The vrf device version of that call is managed by the vrf driver. See
vrf_ip6_out_direct():
err = nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, sk,
skb, NULL, vrf_dev, vrf_ip6_out_direct_finish);
Juniper Business Use Only
