Re: [PATCH net v2 1/2] ipv6: ignore link state in gateway check

[Hangbin Liu]

On Wed, Nov 04, 2026 at 07:56:54PM +0000, Yaroslav Dudkov wrote:
> IPv6 route cannot be added in table when all
> following conditions are true:
> - gateway is not link-local address
> - ignore_routes_with_linkdown=1 on device
> - nexthop has no carrier
> - gateway is not present or covered by any route in table already
> Also multipath routes addition is invalidated by kernel even
> if only one of added nexthops satisfies all above conditions.
> 
> Reproducer:
> 
>   ip netns add t
>   ip -n t link add va type veth peer name vb
>   ip -n t link set va up
>   ip -n t addr add fd00::1/64 dev va nodad
>   ip netns exec t sysctl -w \
>     net.ipv6.conf.va.ignore_routes_with_linkdown=1
>   ip -n t -6 route add 2001:db8::/64 via fd00::2 dev va
>   # added
>   ip -n t -6 route add 2001:db8::/64 table 100 via fd00::2 dev va
>   # RTNETLINK answers: No route to host
>   ip -n t -6 route show table all
>   ip netns del t
> 
> Route should be added because:
> - RT6_LOOKUP_F_IGNORE_LINKSTATE in commit d5d32e4b7668
> ("net: ipv6: Do not consider link state for nexthop validation")
> was added for this
> - the same route is valid in main table (when no specifying table id
> while adding route)
> - fib6_nh_init() initializes nexthops with no carrier
> - IPv4 already does this (fib_check_nh_v4_gw() ignores link state
> using the FIB_LOOKUP_IGNORE_LINKSTATE flag)
> 
> Before commit b2c709cce682 ("ipv6: Convert gateway validation to
> use fib6_info") rt6_lookup() was used for checking if nexthop is
> valid, rt6_lookup called rt6_device_match() which does not check the
> link state. After change rt6_lookup() to fib6_lookup()
> find_match() under fib6_lookup() started to invalidate linkdown
> devices, because RT6_LOOKUP_F_IGNORE_LINKSTATE is not passed to it.
> 
> Adding RT6_LOOKUP_F_IGNORE_LINKSTATE to flags for ip6_route_check_nh()
> solves the problem. RT6_LOOKUP_F_IGNORE_LINKSTATE is already used
> inside the first search ip6_nh_lookup_table() and fixes the
> bug in second search fib6_lookup(). Also RT6_LOOKUP_F_IGNORE_LINKSTATE
> isn't read inside fib6_select_path().
> 
> Fixes: b2c709cce682 ("ipv6: Convert gateway validation to use fib6_info")
> Signed-off-by: Yaroslav Dudkov <aroslavdudkov622@xxxxxxxxx>
> ---
> IPv4 example of this situation:
>   ip netns add t
>   ip -n t link add va type veth peer name vb
>   ip -n t link set va up
>   ip -n t addr add 192.168.0.1/24 dev va
>   ip netns exec t sysctl -w \
>     net.ipv4.conf.va.ignore_routes_with_linkdown=1
>   ip -n t route add 192.0.2.0/24 table 100 via 192.168.0.2 dev va
>   # added
>   ip -n t route show table all
>   ip netns del t
> 
> Also when adding RT6_LOOKUP_F_IGNORE_LINKSTATE to flags of
> ip6_route_check_nh() makes adding this flag inside of
> ip6_nh_lookup_table() unnecessary for this call, making another call in
> ip6_route_check_nh_onlink() with flags=0 the only place where it is
> needed.
> ---
>  net/ipv6/route.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index 94e5ef1c4f83..73d8a2c95602 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -3424,9 +3424,9 @@ static int ip6_route_check_nh(struct net *net,
>  			      netdevice_tracker *dev_tracker,
>  			      struct inet6_dev **idev)
>  {
> +	int flags = RT6_LOOKUP_F_IFACE | RT6_LOOKUP_F_IGNORE_LINKSTATE;
>  	const struct in6_addr *gw_addr = &cfg->fc_gateway;
>  	struct net_device *dev = _dev ? *_dev : NULL;
> -	int flags = RT6_LOOKUP_F_IFACE;
>  	struct fib6_result res = {};
>  	int err = -EHOSTUNREACH;
>  
> -- 
> 2.54.0
> 

Reviewed-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>