netdev - Re: [PATCH v2] net/ipv6: allow device-only routes via the multipath API

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <19acb95fbde.c1def42b209419.2689462649051838277@azey.net>
Date: Fri, 28 Nov 2025 18:49:55 +0100
From: azey <me@...y.net>
To: "nicolasdichtel" <nicolas.dichtel@...nd.com>
Cc: "Jakub Kicinski" <kuba@...nel.org>, "David Ahern" <dsahern@...nel.org>,
	"David S. Miller" <davem@...emloft.net>,
	"Eric Dumazet" <edumazet@...gle.com>,
	"Paolo Abeni" <pabeni@...hat.com>, "Simon Horman" <horms@...nel.org>,
	"netdev" <netdev@...r.kernel.org>,
	"linux-kernel" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] net/ipv6: allow device-only routes via the multipath
 API

On 2025-11-28 17:28:41 +0100  Nicolas Dichtel <nicolas.dichtel@...nd.com> wrote:
> Le 28/11/2025 à 16:54, azey a écrit :
> >> On 2025-11-28 09:38:07 +0100  Nicolas Dichtel <nicolas.dichtel@...nd.com> wrote:
> >>> With IPv6, unlike IPv4, the ECMP next hops can be added one by one. Your commit
> >>> doesn't allow this:
> > 
> > Hold on, I think I understand what you actually meant by this, sorry.
> > I got too focused on regressions from the discussion in v1, I'll make
> > a v3 of the patch that allows dev-only routes to be added via append.
> Yes, that is what I pointed out.
> 
> Please, add some self-tests to show that there is no regression. You probably
> have to test different combinations of NLM_F_* flags. See:
> 
> https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/iproute.c#n2418

Will do, thanks for the pointer.
One last thing I'd like to clarify though: would this behavior not also
itself be considered a regression?

Currently the add and append routes get added separately, and someone
could theoretically be relying on the kernel always picking the last
route instead of making them multipath - essentially still the same
v1 regression.

If not, would it also be acceptable for just any non-RTPROT_KERNEL
routes to automatically be made multipath like this? It's a simple fix,
it'd make appending work and it'd still prevent the specific v1
regression for the case of two interfaces on the same subnet - example
diff attached.

---
 include/net/ip6_route.h | 6 ++++--
 net/ipv6/route.c        | 9 ---------
 2 files changed, 4 insertions(+), 11 deletions(-)

diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 7c5512baa4b2..c20beb7bcdb9 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -72,9 +72,11 @@ static inline bool rt6_need_strict(const struct in6_addr *daddr)
  */
 static inline bool rt6_qualify_for_ecmp(const struct fib6_info *f6i)
 {
-	/* the RTF_ADDRCONF flag filters out RA's */
+	/* the RTF_ADDRCONF flag filters out RA's,
+	 * and RTPROT_KERNEL filters out local addresses' subnet routes
+	 */
 	return !(f6i->fib6_flags & RTF_ADDRCONF) && !f6i->nh &&
-		f6i->fib6_nh->fib_nh_gw_family;
+		(f6i->fib6_nh->fib_nh_gw_family || f6i->fib6_protocol != RTPROT_KERNEL);
 }
 
 void ip6_route_input(struct sk_buff *skb);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index aee6a10b112a..865d9139994a 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5119,7 +5119,6 @@ static int rtm_to_fib6_multipath_config(struct fib6_config *cfg,
 	}
 
 	do {
-		bool has_gateway = cfg->fc_flags & RTF_GATEWAY;
 		int attrlen = rtnh_attrlen(rtnh);
 
 		if (attrlen > 0) {
@@ -5133,17 +5132,9 @@ static int rtm_to_fib6_multipath_config(struct fib6_config *cfg,
 						       "Invalid IPv6 address in RTA_GATEWAY");
 					return -EINVAL;
 				}
-
-				has_gateway = true;
 			}
 		}
 
-		if (newroute && (cfg->fc_nh_id || !has_gateway)) {
-			NL_SET_ERR_MSG(extack,
-				       "Device only routes can not be added for IPv6 using the multipath API.");
-			return -EINVAL;
-		}
-
 		rtnh = rtnh_next(rtnh, &remaining);
 	} while (rtnh_ok(rtnh, remaining));
 

base-commit: bd10acae08aeb9cd2f555acdbacb98b9fbb02a27
-- 
2.51.0