lwtunnel_fill_encap() dumps RTA_ENCAP without NLA_F_NESTED, and
"ip route restore" sends the routes saved by "ip route save" back to
the kernel unchanged. rpl and ioam6 break on the same path:
lwtunnel_build_state() hands the restored RTA_ENCAP to their
build_state callbacks, which parse it with nla_parse_nested() and so
require the flag. Restoring an rpl route fails as below, and an ioam6
route fails with the same error:
# ip -6 route add 2001:db8:1::/64 encap rpl segs 2001:db8::2 dev dummy0
# ip -6 route save 2001:db8:1::/64 > route.bin
# ip -6 route del 2001:db8:1::/64
# ip -6 route restore < route.bin
Error: NLA_F_NESTED is missing.
Setting the flag in the dump is not an option: userspace that does not
mask it off the attribute type, such as parse_rtattr() in iproute2,
would no longer find RTA_ENCAP.
Add lwtunnel_nla_parse(), which validates the nested attributes
strictly but does not require the flag on RTA_ENCAP itself, and use it
in rpl and ioam6. Switching them to nla_parse_nested_deprecated()
instead would also make them accept unknown attributes, which they have
rejected since they were added.
Fixes: a7a29f9c361f ("net: ipv6: add rpl sr tunnel")
Fixes: 3edede08ff37 ("ipv6: ioam: Support for IOAM injection with lwtunnels")
Assisted-by: LLM
Signed-off-by: Yuya Kusakabe <[email protected]>
---
include/net/lwtunnel.h | 27 +++++++++++++++++++++++++++
net/ipv6/ioam6_iptunnel.c | 4 ++--
net/ipv6/rpl_iptunnel.c | 4 ++--
3 files changed, 31 insertions(+), 4 deletions(-)
diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h
index 26232f603e33..046978d6224c 100644
--- a/include/net/lwtunnel.h
+++ b/include/net/lwtunnel.h
@@ -6,6 +6,7 @@
#include <linux/netdevice.h>
#include <linux/skbuff.h>
#include <linux/types.h>
+#include <net/netlink.h>
#include <net/route.h>
#define LWTUNNEL_HASH_BITS 7
@@ -37,6 +38,7 @@ struct lwtunnel_state {
};
struct lwtunnel_encap_ops {
+ /* encap may lack NLA_F_NESTED, parse it with lwtunnel_nla_parse() */
int (*build_state)(struct net *net, struct nlattr *encap,
unsigned int family, const void *cfg,
struct lwtunnel_state **ts,
@@ -53,6 +55,31 @@ struct lwtunnel_encap_ops {
struct module *owner;
};
+/**
+ * lwtunnel_nla_parse - parse the attributes nested in an lwtunnel encap
+ * @tb: destination array with maxtype+1 elements
+ * @maxtype: maximum attribute type to be expected
+ * @nla: encap attribute passed to &lwtunnel_encap_ops.build_state, or an
+ * attribute nested in it
+ * @policy: validation policy
+ * @extack: extended ACK report struct
+ *
+ * The encap attribute, and some of the attributes nested in it, have always
+ * been dumped without NLA_F_NESTED, and userspace such as "ip route restore"
+ * sends a dump back unchanged, so the flag cannot be required on @nla.
+ * The attributes nested in @nla are still validated strictly.
+ *
+ * Return: 0 on success or a negative error code.
+ */
+static inline int lwtunnel_nla_parse(struct nlattr *tb[], int maxtype,
+ const struct nlattr *nla,
+ const struct nla_policy *policy,
+ struct netlink_ext_ack *extack)
+{
+ return nla_parse(tb, maxtype, nla_data(nla), nla_len(nla), policy,
+ extack);
+}
+
#ifdef CONFIG_LWTUNNEL
DECLARE_STATIC_KEY_FALSE(nf_hooks_lwtunnel_enabled);
diff --git a/net/ipv6/ioam6_iptunnel.c b/net/ipv6/ioam6_iptunnel.c
index cfb2c41634a0..946c360ff214 100644
--- a/net/ipv6/ioam6_iptunnel.c
+++ b/net/ipv6/ioam6_iptunnel.c
@@ -113,8 +113,8 @@ static int ioam6_build_state(struct net *net, struct nlattr
*nla,
if (family != AF_INET6)
return -EINVAL;
- err = nla_parse_nested(tb, IOAM6_IPTUNNEL_MAX, nla,
- ioam6_iptunnel_policy, extack);
+ err = lwtunnel_nla_parse(tb, IOAM6_IPTUNNEL_MAX, nla,
+ ioam6_iptunnel_policy, extack);
if (err < 0)
return err;
diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c
index 4e10adcd70e8..1861af408bbc 100644
--- a/net/ipv6/rpl_iptunnel.c
+++ b/net/ipv6/rpl_iptunnel.c
@@ -78,8 +78,8 @@ static int rpl_build_state(struct net *net, struct nlattr
*nla,
if (family != AF_INET6)
return -EINVAL;
- err = nla_parse_nested(tb, RPL_IPTUNNEL_MAX, nla,
- rpl_iptunnel_policy, extack);
+ err = lwtunnel_nla_parse(tb, RPL_IPTUNNEL_MAX, nla,
+ rpl_iptunnel_policy, extack);
if (err < 0)
return err;
--
2.50.1
