From: Robert Sanford <[email protected]> Both FIB dataplanes can overwrite their entire lookup table when a prefix whose range ends at the top of the address space is added, deleted, or has its next hop changed, while more-specific routes cover its range up to that point. The call returns 0, so the corruption is silent.
One real-world trigger is a default route coexisting with explicit /1 routes: with 0.0.0.0/0, 0.0.0.0/1 and 128.0.0.0/1 installed, deleting 0.0.0.0/0 makes every lookup miss. IPv6 behaves the same with ::/0, ::/1 and 8000::/1. In modify_fib() (dir24_8.c) and modify_dp() (trie.c), the branch that skips a route starting exactly at the current left edge has no wraparound check, while the branch that installs a gap does. Patches 1 and 2 add the missing check. Patches 3 and 4 add unit tests that fail without the fixes and pass with them. Robert Sanford (4): fib: fix full table overwrite on address wraparound fib6: fix full table overwrite on address wraparound test/fib: reproduce table overwrite on address wraparound test/fib6: reproduce table overwrite on address wraparound app/test/test_fib.c | 94 +++++++++++++++++++++++++++++++++++++++ app/test/test_fib6.c | 103 +++++++++++++++++++++++++++++++++++++++++++ lib/fib/dir24_8.c | 6 +++ lib/fib/trie.c | 6 +++ 4 files changed, 209 insertions(+) -- 2.34.1
