[PATCH] ipv6: check per-interface proxy_ndp in forwarding and NA paths

[PATCH] ipv6: check per-interface proxy_ndp in forwarding and NA paths

[Adriano Cordova]

proxy_ndp can be enabled per interface, with net.ipv6.conf.all.proxy_ndp
as a global default. ndisc_recv_ns() checks both, but ip6_forward() and
ndisc_recv_na() check only the global value. With the per-interface proxy
ndp set and the global one left at 0, the router answers proxy NS but
does not pass NDP messages to the proxied target.

Check both values at these two sites, as ndisc_recv_ns() already does.

Fixes: fbea49e1e240 ("[IPV6] NDISC: Add proxy_ndp sysctl.")
Signed-off-by: Adriano Cordova <adrianox@gmail.com>
---
 net/ipv6/ip6_output.c | 4 ++--
 net/ipv6/ndisc.c      | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 550965058991..738fa46a892a 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -581,8 +581,8 @@ int ip6_forward(struct sk_buff *skb)
 		return -ETIMEDOUT;
 	}
 
-	/* XXX: idev->cnf.proxy_ndp? */
-	if (READ_ONCE(net->ipv6.devconf_all->proxy_ndp) &&
+	if ((READ_ONCE(net->ipv6.devconf_all->proxy_ndp) ||
+	     (idev && READ_ONCE(idev->cnf.proxy_ndp))) &&
 	    pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev)) {
 		int proxied = ip6_forward_proxy_check(skb);
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 75515fd99383..f787082069b7 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1097,9 +1097,9 @@ static enum skb_drop_reason ndisc_recv_na(struct sk_buff *skb)
 		 */
 		if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
 		    READ_ONCE(net->ipv6.devconf_all->forwarding) &&
-		    READ_ONCE(net->ipv6.devconf_all->proxy_ndp) &&
+		    (READ_ONCE(net->ipv6.devconf_all->proxy_ndp) ||
+		     (idev && READ_ONCE(idev->cnf.proxy_ndp))) &&
 		    pneigh_lookup(&nd_tbl, net, &msg->target, dev)) {
-			/* XXX: idev->cnf.proxy_ndp */
 			goto out;
 		}
 
-- 
2.51.0

Re: [PATCH] ipv6: check per-interface proxy_ndp in forwarding and NA paths

[Hangbin Liu]

On Fri, Sep 18, 2026 at 12:14:05PM -0300, Adriano Cordova wrote:
> proxy_ndp can be enabled per interface, with net.ipv6.conf.all.proxy_ndp
> as a global default. ndisc_recv_ns() checks both, but ip6_forward() and
> ndisc_recv_na() check only the global value. With the per-interface proxy
> ndp set and the global one left at 0, the router answers proxy NS but
> does not pass NDP messages to the proxied target.
> 
> Check both values at these two sites, as ndisc_recv_ns() already does.
> 
> Fixes: fbea49e1e240 ("[IPV6] NDISC: Add proxy_ndp sysctl.")
> Signed-off-by: Adriano Cordova <adrianox@gmail.com>
> ---
>  net/ipv6/ip6_output.c | 4 ++--
>  net/ipv6/ndisc.c      | 4 ++--
>  2 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> index 550965058991..738fa46a892a 100644
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -581,8 +581,8 @@ int ip6_forward(struct sk_buff *skb)
>  		return -ETIMEDOUT;
>  	}
>  
> -	/* XXX: idev->cnf.proxy_ndp? */
> -	if (READ_ONCE(net->ipv6.devconf_all->proxy_ndp) &&
> +	if ((READ_ONCE(net->ipv6.devconf_all->proxy_ndp) ||
> +	     (idev && READ_ONCE(idev->cnf.proxy_ndp))) &&
>  	    pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev)) {
>  		int proxied = ip6_forward_proxy_check(skb);
>  
> diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
> index 75515fd99383..f787082069b7 100644
> --- a/net/ipv6/ndisc.c
> +++ b/net/ipv6/ndisc.c
> @@ -1097,9 +1097,9 @@ static enum skb_drop_reason ndisc_recv_na(struct sk_buff *skb)
>  		 */
>  		if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
>  		    READ_ONCE(net->ipv6.devconf_all->forwarding) &&
> -		    READ_ONCE(net->ipv6.devconf_all->proxy_ndp) &&
> +		    (READ_ONCE(net->ipv6.devconf_all->proxy_ndp) ||
> +		     (idev && READ_ONCE(idev->cnf.proxy_ndp))) &&
>  		    pneigh_lookup(&nd_tbl, net, &msg->target, dev)) {
> -			/* XXX: idev->cnf.proxy_ndp */
>  			goto out;
>  		}
>  
> -- 
> 2.51.0
> 

LGTM

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>

Re: [PATCH] ipv6: check per-interface proxy_ndp in forwarding and NA paths

[Ido Schimmel]

On Fri, Sep 18, 2026 at 12:14:05PM -0300, Adriano Cordova wrote:
> proxy_ndp can be enabled per interface, with net.ipv6.conf.all.proxy_ndp
> as a global default. ndisc_recv_ns() checks both, but ip6_forward() and
> ndisc_recv_na() check only the global value. With the per-interface proxy
> ndp set and the global one left at 0, the router answers proxy NS but
> does not pass NDP messages to the proxied target.
> 
> Check both values at these two sites, as ndisc_recv_ns() already does.
> 
> Fixes: fbea49e1e240 ("[IPV6] NDISC: Add proxy_ndp sysctl.")
> Signed-off-by: Adriano Cordova <adrianox@gmail.com>

Do you have an actual use case for this? Changing a 20 years old user
visible behavior for the sole reason of removing a TODO comment is not
good practice.