netdev - [PATCH iproute2] ip route: Set rtm_dst_len to 32 for all ip route get requests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 17 May 2019 10:59:13 -0700
From:   David Ahern <dsahern@...nel.org>
To:     stephen@...workplumber.org
Cc:     netdev@...r.kernel.org, Jason@...c4.com,
        David Ahern <dsahern@...il.com>
Subject: [PATCH iproute2] ip route: Set rtm_dst_len to 32 for all ip route get requests

From: David Ahern <dsahern@...il.com>

Jason reported that ip route get with a prefix length is now
failing:
    $ 192.168.50.0/24
    RTNETLINK answers: Invalid argument

iproute2 now uses strict mode and strict mode in the kernel
requires rtm_dst_len to be 32. Non-strict mode ignores the
prefix length, so this allows ip to work without affecting
existing users who add a prefix length to the request.

Fixes: aea41afcfd6d6 ("ip bridge: Set NETLINK_GET_STRICT_CHK on socket")
Reported-by: Jason A. Donenfeld <Jason@...c4.com>
Signed-off-by: David Ahern <dsahern@...il.com>
---
 ip/iproute.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/ip/iproute.c b/ip/iproute.c
index 2b3dcc5dbd53..d980b86ffd42 100644
--- a/ip/iproute.c
+++ b/ip/iproute.c
@@ -2035,7 +2035,11 @@ static int iproute_get(int argc, char **argv)
 			if (addr.bytelen)
 				addattr_l(&req.n, sizeof(req),
 					  RTA_DST, &addr.data, addr.bytelen);
-			req.r.rtm_dst_len = addr.bitlen;
+			/* kernel ignores prefix length on 'route get'
+			 * requests; to allow ip to work with strict mode
+			 * but not break existing users, just set to 32
+			 */
+			req.r.rtm_dst_len = 32;
 			address_found = true;
 		}
 		argc--; argv++;
-- 
2.11.0