netdev - Re: [PATCH v2] net/ipv6: allow device-only routes via the multipath API

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <19aca794ddd.105d1f97f173752.5540866508598154532@azey.net>
Date: Fri, 28 Nov 2025 13:38:58 +0100
From: azey <me@...y.net>
To: "nicolasdichtel" <nicolas.dichtel@...nd.com>
Cc: "Jakub Kicinski" <kuba@...nel.org>, "David Ahern" <dsahern@...nel.org>,
	"David S. Miller" <davem@...emloft.net>,
	"Eric Dumazet" <edumazet@...gle.com>,
	"Paolo Abeni" <pabeni@...hat.com>, "Simon Horman" <horms@...nel.org>,
	"netdev" <netdev@...r.kernel.org>,
	"linux-kernel" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] net/ipv6: allow device-only routes via the multipath
 API

On 2025-11-28 09:38:07 +0100  Nicolas Dichtel <nicolas.dichtel@...nd.com> wrote:
> With IPv6, unlike IPv4, the ECMP next hops can be added one by one. Your commit
> doesn't allow this:
> 
> $ ip -6 route add 2002::/64 via fd00:125::2 dev ntfp2
> $ ip -6 route append 2002::/64 dev ntfp3
> $ ip -6 route
> 2002::/64 via fd00:125::2 dev ntfp2 metric 1024 pref medium
> 2002::/64 dev ntfp3 metric 1024 pref medium
> ...
> $ ip -6 route append 2002::/64 via fd00:175::2 dev ntfp3
> $ ip -6 route
> 2002::/64 metric 1024 pref medium
>         nexthop via fd00:125::2 dev ntfp2 weight 1
>         nexthop via fd00:175::2 dev ntfp3 weight 1
> 
> Note that the previous route via ntfp3 has been removed.

I just tested your example in a VM with my patch, and everything works
as you described. This is due to fib6_explicit_ecmp not overriding
rt6_qualify_for_ecmp(), but rather supplementing it with || - the
intention was for default behavior to be preserved for routes that
aren't created via ip6_route_multipath_add(), and from this example it
seems to work correctly in that regard.

And for ip6_route_multipath_add() routes, as I stated earlier the
behavior should not change either (except for the gateway check,
which is the only thing this patch wants to change).

wg0 has fd00::1/64, wg1 has fd00::2/64; Exact command history:

$ ip -6 r add 2002::/64 via fd00::2 dev wg0
$ ip -6 r append 2002::/64 dev wg1
$ ip -6 r
2002::/64 via fd00::2 dev wg0 metric 1024 pref medium
2002::/64 dev wg1 metric 1024 pref medium
...
$ ip -6 r append 2002::/64 via fd01::2 dev wg1
$ ip -6 r
2002::/64 metric 1024 pref medium
	nexthop via fd00::2 dev wg0 weight 1 
	nexthop via fd01::2 dev wg1 weight 1
...

To also test the patch's functionality:

$ ip -6 r add 2003::/64 nexthop dev wg0 nexthop dev wg1
$ ip -6 r
2002::/64 metric 1024 pref medium
	nexthop via fd00::2 dev wg0 weight 1 
	nexthop via fd01::2 dev wg1 weight 1 
2003::/64 metric 1024 pref medium
	nexthop dev wg0 weight 1 
	nexthop dev wg1 weight 1
...

And to make sure the v1 regression isn't present:

$ ip a add fd03::1/64 dev wg0
$ ip a add fd03::2/64 dev wg1
$ ip -6 r
2002::/64 metric 1024 pref medium
	nexthop via fd00::2 dev wg0 weight 1 
	nexthop via fd01::2 dev wg1 weight 1 
2003::/64 metric 1024 pref medium
	nexthop dev wg0 weight 1 
	nexthop dev wg1 weight 1
fd03::/64 dev wg0 proto kernel metric 256 pref medium
fd03::/64 dev wg1 proto kernel metric 256 pref medium
...