Re: [PATCH net v2] net/ipv6: don't route packets with unknown source address

[Matthieu Baerts]

Hi Íñigo,

On 04/09/2026 00:38, Jakub Kicinski wrote:
> On Thu,  3 Sep 2026 14:10:40 +0200 Íñigo Huguet wrote:
>> Don't allow routing packets with a source address that is not configured
>> in the host. Allow it only in certain cases like when using a
>> transparent socket, by setting the ANYSRC flag in flowi_flags.
> 
> breaks a bunch of selftests, too, FWIW
> Please make sure to mend those if you want to forge ahead as a non-fix
> 
>   - selftests/net/xfrm_state.sh:
>       "IPv6 unreachable from IPsec gateway s2" [FAIL]
>       "IPv6 MTU exceeded from IPsec gateway s2" [FAIL]
>     (the equivalent IPv4 cases still pass)
> 
>   - selftests/net/vrf_route_leaking.sh:
>       "VRF ICMP local IPv6" [FAIL]
>       "VRF tcp local connection IPv6" [FAIL]
>       "VRF udp local connection IPv6" [FAIL]
> 
>   - selftests/net/srv6_encap_lookup_l3vpn_test.sh:
>       "IPv6 connectivity: rt-1 -> rt-2 (tenant 100/200)" [FAIL]
>       "IPv6 connectivity: rt-2 -> rt-1 (tenant 100/200)" [FAIL]
>     (again, the IPv4 variants of the same tests pass)
> ...

Just in case, do not hesitate to look at the new countainers that might
help you running those tests locally:

 https://lore.kernel.org/9c66a2b4-2787-4421-bc9b-627de2f708bd@xxxxxxxxxx

 https://github.com/linux-netdev/nipa/wiki/Running-Netdev-CI-tests-locally

Cheers,
Matt