netdev - Re: RTM_DELROUTE not sent anymore when deleting (last) nexthop of routes in 6.1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 24 Nov 2022 16:20:49 +0100
From:   Jonas Gorski <jonas.gorski@...il.com>
To:     Ido Schimmel <idosch@...sch.org>
Cc:     Network Development <netdev@...r.kernel.org>,
        David Ahern <dsahern@...nel.org>
Subject: Re: RTM_DELROUTE not sent anymore when deleting (last) nexthop of
 routes in 6.1

On Thu, 24 Nov 2022 at 15:50, Ido Schimmel <idosch@...sch.org> wrote:
>
> On Thu, Nov 24, 2022 at 03:40:19PM +0100, Jonas Gorski wrote:
> > On Thu, 24 Nov 2022 at 15:15, Jonas Gorski <jonas.gorski@...il.com> wrote:
> > >
> > > Hi Ido,
> > >
> > > On Thu, 24 Nov 2022 at 13:41, Ido Schimmel <idosch@...sch.org> wrote:
> > > >
> > > > On Thu, Nov 24, 2022 at 10:20:00AM +0100, Jonas Gorski wrote:
> > > > > Hello,
> > > > >
> > > > > when an IPv4 route gets removed because its nexthop was deleted, the
> > > > > kernel does not send a RTM_DELROUTE netlink notifications anymore in
> > > > > 6.1. A bisect lead me to 61b91eb33a69 ("ipv4: Handle attempt to delete
> > > > > multipath route when fib_info contains an nh reference"), and
> > > > > reverting it makes it work again.
> > > > >
> > > >
> > > > Are you running an upstream kernel?
> > >
> > > Okay, after having a second look, you are right, and I got myself
> > > confused by IPv6 generating RTM_DELROUTE notifications, but which is
> > > besides the point.
> > >
> > > The point where it fails is that FRR tries to delete its route(s), and
> > > fails to do so with this commit applied (=> RTM_DELROUTE goes
> > > missing), then does the RTM_DELNEXTHOP.
> > >
> > > So while there is indeed no RTM_DELROUTE generated in response to the
> > > kernel, it was generated when FRR was successfully deleting its routes
> > > before.
> > >
> > > Not sure if this already qualifies as breaking userspace though, but
> > > it's definitely something that used to work with 6.0 and before, and
> > > does not work anymore now.
> > >
> > > The error in FRR log is:
> > >
> > > [YXPF5-B2CE0] netlink_route_multipath_msg_encode: RTM_DELROUTE
> > > 10.0.1.0/24 vrf 0(254)
> > > [HYEHE-CQZ9G] nl_batch_send: netlink-dp (NS 0), batch size=44, msg cnt=1
> > > [XS99C-X3KS5] netlink-dp (NS 0): error: No such process
> > > type=RTM_DELROUTE(25), seq=22, pid=2419702167
> > >
> > > with the revert it succeeds.
> > >
> > > I'll see if I can get a better idea of the actual netlink message sent.
> >
> > Okay, found the knob:
> >
> > nlmsghdr [len=44 type=(25) DELROUTE flags=(0x0401)
> > {REQUEST,(ATOMIC|CREATE)} seq=22 pid=2185212923]
> >   rtmsg [family=(2) AF_INET dstlen=24 srclen=0 tos=0 table=254
> > protocol=(186) UNKNOWN scope=(0) UNIVERSE type=(0) UNSPEC flags=0x0000
> > {}]
> >     rta [len=8 (payload=4) type=(1) DST]
> >       10.0.1.0
> >     rta [len=8 (payload=4) type=(6) PRIORITY]
> >       20
>
> The route is deleted with only prefix information (NH_ID not specified).
> Matches this comment and the code:
> https://github.com/FRRouting/frr/blob/master/zebra/rt_netlink.c#L2091
>
> > netlink-dp (NS 0): error: No such process type=RTM_DELROUTE(25),
> > seq=22, pid=2185212923
> >
> > The route was created via
> >
> > nlmsghdr [len=52 type=(24) NEWROUTE flags=(0x0501)
> > {REQUEST,DUMP,(ROOT|REPLACE|CAPPED),(ATOMIC|CREATE)} seq=18
> > pid=2185212923]
> >  rtmsg [family=(2) AF_INET dstlen=24 srclen=0 tos=0 table=254
> > protocol=(186) UNKNOWN scope=(0) UNIVERSE type=(1) UNICAST
> > flags=0x0000 {}]
> >     rta [len=8 (payload=4) type=(1) DST]
> >       10.0.1.0
> >     rta [len=8 (payload=4) type=(6) PRIORITY]
> >        20
> >      rta [len=8 (payload=4) type=(30) NH_ID]
> >      18
>
> Here the nexthop ID is obviously present.
>
> Let me try to fix it and add a test for this flow.
>
> Thanks for all the details!

You are welcome, and thanks for the quick response!

We have an integration test using FRR that got broken by this, so I
can also easily test anything you throw at me (assuming CET working
hours).

Regards
Jonas