Skip to content

Incorrect policy routing ip rule cleanup on reload with ip4table/ip6table change #61

@neocturne

Description

@neocturne

interface_change_config() changes the ip4table and ip6table fields of if_old here:

netifd/interface.c

Lines 1369 to 1370 in 777f594

UPDATE(ip4table, reload_ip);
UPDATE(ip6table, reload_ip);
. After the update, interface_ip_set_enabled(..., false) and interface_set_prefix_address() will clean up a number of implicitly created ip rules (set_ip_source_policy() and set_ip_lo_policy()) before setting them up again, but the cleanup will attempt to delete rules with the new ip[46]table instead of its old value, so the deletion fails. Only a full network restart will clean up rules properly.

I don't know the code well enough to propose a proper fix; the following ideas did not work out so far:

  • Set interface_ip_set_enabled(..., false) before updating the fields (probably possible in the reload_ip == true case, unclear if the reload == true case can be made to work)
  • Delete rule with 'unspecified' table lookup (there may be multiple rules that only differ by the table number)
  • Store the table numbers used for the last rule creation in the interface_ip_settings, so the same table can be used for cleanup (possible for interface_ip_set_enabled(), looks more complicated for ``interface_set_prefix_address()`

It is unclear to me if a combination of the above ideas could be sufficient for a fix, or if more precise tracking of created rules would be required for cleanup.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions