[PATCH net 0/2] ipv6: honor rule suppression in raw FIB lookups

[Leonard Lausen]

IPv6 raw FIB lookups ignore suppress_prefixlength and suppress_ifgroup
because the suppression callback only examines the dst-based result.
This can make nftables select a suppressed main-table default instead of
a VPN route, causing strict reverse-path filtering to drop VPN replies.

Patch 1 supplies the prefix length and output device from the appropriate
result representation. It preserves reject results: raw lookups can
return success with RTF_REJECT set, whereas dst-based lookups report an
error and skip suppression. Destination-reference handling is unchanged.

Patch 2 extends the existing nft_fib.sh fixture with unicast suppression
and retention checks, plus a loop covering all three terminal reject
route types under both suppression attributes.

The series targets net and is based on v7.4-rc2 (7475ea8b5861).

Validation:
- The original VPN failure was reproduced on unmodified v7.4-rc2 in QEMU
  without kernel instrumentation.
- The final fib6_rules.c compiles without warnings with the laptop's
  existing configuration. Its extracted suppression callback passes 17
  ASan/UBSan checks, including reject results from blackhole nexthops and
  destination-reference handling.
- On the rebuilt v7.4-rc2-based laptop kernel, all ten added selftest
  cases pass and nft_fib.sh exits successfully. A separate twelve-probe
  test confirms that blackhole, unreachable, prohibit and blackhole
  nexthop results remain terminal with no suppression, prefix suppression
  and matching interface-group suppression.

OpenAI Codex assisted with investigation, reproduction, implementation,
testing and these descriptions. The prompts asked it to investigate the
VPN failure, validate on v7.4-rc2, simplify the series and preserve
terminal reject routes. Both patches carry Assisted-by: LLM.

Leonard Lausen (2):
  ipv6: honor rule suppression in raw FIB lookups
  selftests: netfilter: cover IPv6 FIB rule suppression

 net/ipv6/fib6_rules.c                         | 32 ++++++---
 .../selftests/net/netfilter/nft_fib.sh        | 68 +++++++++++++++++++
 2 files changed, 90 insertions(+), 10 deletions(-)


base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.55.0