Re: [PATCH net v2] net/ipv6: don't route packets with unknown source address

Jakub Kicinski <[email protected]> Thu, 3 Sep 2026 15:38:48 -0700

Newsgroups	gmane.linux.kernel.bpf,gmane.linux.network,gmane.linux.kernel,gmane.comp.security.firewalls.netfilter.devel
Message-ID	<[email protected]>

On Thu,  3 Sep 2026 14:10:40 +0200 Íñigo Huguet wrote:
> Don't allow routing packets with a source address that is not configured
> in the host. Allow it only in certain cases like when using a
> transparent socket, by setting the ANYSRC flag in flowi_flags.

breaks a bunch of selftests, too, FWIW
Please make sure to mend those if you want to forge ahead as a non-fix

  - selftests/net/xfrm_state.sh:
      "IPv6 unreachable from IPsec gateway s2" [FAIL]
      "IPv6 MTU exceeded from IPsec gateway s2" [FAIL]
    (the equivalent IPv4 cases still pass)

  - selftests/net/vrf_route_leaking.sh:
      "VRF ICMP local IPv6" [FAIL]
      "VRF tcp local connection IPv6" [FAIL]
      "VRF udp local connection IPv6" [FAIL]

  - selftests/net/srv6_encap_lookup_l3vpn_test.sh:
      "IPv6 connectivity: rt-1 -> rt-2 (tenant 100/200)" [FAIL]
      "IPv6 connectivity: rt-2 -> rt-1 (tenant 100/200)" [FAIL]
    (again, the IPv4 variants of the same tests pass)
...