Blast from the past. 10 years back Wei Dong submitted the patch found (amongst
several places) here:
http://lists.openwall.net/netdev/2007/01/30/20
Problem:
I have a firewall rule that DNATs ipv6 traffic from a destination address to
::1. The route lookup gives me the Main table & forwards that DNAT'd traffic
instead of sending it to local process.
Example:
Looking at this from a netfilter point of view, a client (IP of fd00::5)
requests a web page at [2000::25:0:0:1]:8080. The firewall rule DNATs it to ::1
(note that I threw a -j TRACE in raw's REROUTING).
TRACE: nat:PREROUTING:rule:2 SRC=fd00::5 DST=2000::25:0:0:1
TRACE: mangle:FORWARD:rule:1 SRC=fd00::5 DST=::1
The patch is verbatim (as is the subject line for this email). Traffic DNAT'd
to ::1 now goes to mangle's INPUT chain after routing decision. I'm not sure
why it was removed--I'm assuming it was an accident--as I can't find a record
in the mailing list archive.
diff --git a/gpl/kernel/linux/net/ipv6/route.c
b/gpl/kernel/linux/net/ipv6/route.c
index 3809ca2..2a2563f 100644
--- a/gpl/kernel/linux/net/ipv6/route.c
+++ b/gpl/kernel/linux/net/ipv6/route.c
@@ -611,7 +611,7 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
int m;
m = rt6_check_dev(rt, oif);
- if (!m && (strict & RT6_LOOKUP_F_IFACE))
+ if (!m && (rt->rt6i_flags & RTF_CACHE) && (strict & RT6_LOOKUP_F_IFACE))
return RT6_NUD_FAIL_HARD;
#ifdef CONFIG_IPV6_ROUTER_PREF
m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;
__
Mike Ulmer
