Commit 72dcac96 authored Dec 10, 2015 by Robert Shearman Committed by David S. Miller Dec 12, 2015

mpls: don't dump RTA_VIA attribute if not specified



The problem seen is that when adding a route with a nexthop with no
via address specified, iproute2 generates bogus output:

  # ip -f mpls route add 100 dev lo
  # ip -f mpls route list
  100 via inet 0.0.8.0 dev lo

The reason for this is that the kernel generates an RTA_VIA attribute
with the family set to AF_INET, but the via address data having zero
length. The cause of family being AF_INET is that on route insert
cfg->rc_via_table is left set to 0, which just happens to be
NEIGH_ARP_TABLE which is then translated into AF_INET.

iproute2 doesn't validate the length prior to printing and so prints
garbage. Although it could be fixed to do the validation, I would
argue that AF_INET addresses should always be exactly 4 bytes so the
kernel is really giving userspace bogus data.

Therefore, avoid generating the RTA_VIA attribute when dumping the
route if the via address wasn't specified on add/modify. This is
indicated by NEIGH_ARP_TABLE and a zero via address length - if the
user specified a via address the address length would have been
validated such that it was 4 bytes. Although this is a change in
behaviour that is visible to userspace, I believe that what was
generated before was invalid and as such userspace wouldn't be
expecting it.

Signed-off-by: Robert Shearman <rshearma@brocade.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent a3e948e8

net/mpls/af_mpls.c

+6 −2

Original line number	Diff line number	Diff line
		@@ -1235,7 +1235,9 @@ static int mpls_dump_route(struct sk_buff *skb, u32 portid, u32 seq, int event,
		nla_put_labels(skb, RTA_NEWDST, nh->nh_labels,
		nh->nh_label))
		goto nla_put_failure;
		if (nla_put_via(skb, nh->nh_via_table, mpls_nh_via(rt, nh),
		if ((nh->nh_via_table != NEIGH_ARP_TABLE \|\|
		nh->nh_via_alen != 0) &&
		nla_put_via(skb, nh->nh_via_table, mpls_nh_via(rt, nh),
		nh->nh_via_alen))
		goto nla_put_failure;
		dev = rtnl_dereference(nh->nh_dev);
		@@ -1323,7 +1325,9 @@ static inline size_t lfib_nlmsg_size(struct mpls_route *rt)

		if (nh->nh_dev)
		payload += nla_total_size(4); /* RTA_OIF */
		payload += nla_total_size(2 + nh->nh_via_alen); /* RTA_VIA */
		if (nh->nh_via_table != NEIGH_ARP_TABLE \|\|
		nh->nh_via_alen != 0) /* RTA_VIA */
		payload += nla_total_size(2 + nh->nh_via_alen);
		if (nh->nh_labels) /* RTA_NEWDST */
		payload += nla_total_size(nh->nh_labels * 4);
		} else {