From: "Zoltán Böszörményi" <zboszor@gmail.com>
To: connman@lists.linux.dev
Cc: "Zoltán Böszörményi" <zboszor@gmail.com>
Subject: [PATCH] Don't add route for invalid dst and gateway address combinations
Date: Mon, 28 Aug 2023 13:18:46 +0200 [thread overview]
Message-ID: <20230828111846.2170668-1-zboszor@gmail.com> (raw)
Don't add route for link-local or unspecified destination address
coupled with unspecified gateway address.
When the machine has multiple interfaces, it may occur that some
of them don't have a DHCP server behind them, and there is no
fixed address assigned to them either.
Such interfaces get a link-local address assigned by Connman and
routes are added to them with 0.0.0.0 gateway address on IPv4.
Adding such routes breaks networking because these routes behave
exactly like the default route but they take precedence over the
default and are the equivalent of /dev/null for network packets.
Observed with virtual veth* interfaces created by docker where
only the bridge interface has a DHCP assigned address.
---
src/inet.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/src/inet.c b/src/inet.c
index 4039a73c..3465d50c 100644
--- a/src/inet.c
+++ b/src/inet.c
@@ -611,6 +611,16 @@ int connman_inet_add_network_route(int index, const char *host,
addr.sin_addr.s_addr = inet_addr(host);
memcpy(&rt.rt_dst, &addr, sizeof(rt.rt_dst));
+ /*
+ * Don't add a routes for link-local or unspecified
+ * destination address coupled with unspecified gateway.
+ */
+ if ((!host || is_addr_ll(AF_INET, (struct sockaddr *)&addr) || __connman_inet_is_any_addr(host, AF_INET))
+ && (!gateway || __connman_inet_is_any_addr(gateway, AF_INET))) {
+ close(sk);
+ return -EINVAL;
+ }
+
memset(&addr, 0, sizeof(addr));
addr.sin_family = AF_INET;
if (gateway)
@@ -745,6 +755,7 @@ int connman_inet_add_ipv6_network_route(int index, const char *host,
const char *gateway,
unsigned char prefix_len)
{
+ struct sockaddr_in6 addr;
struct in6_rtmsg rt;
int sk, err = 0;
@@ -753,6 +764,19 @@ int connman_inet_add_ipv6_network_route(int index, const char *host,
if (!host)
return -EINVAL;
+ if (inet_pton(AF_INET6, host, &addr.sin6_addr) != 1) {
+ err = -errno;
+ goto out;
+ }
+
+ /*
+ * Don't add a route for link-local or unspecified
+ * destination address coupled with unspecified gateway.
+ */
+ if ((!host || is_addr_ll(AF_INET6, (struct sockaddr *)&addr) || __connman_inet_is_any_addr(host, AF_INET6))
+ && (!gateway || __connman_inet_is_any_addr(gateway, AF_INET6)))
+ return -EINVAL;
+
memset(&rt, 0, sizeof(rt));
rt.rtmsg_dst_len = prefix_len;
--
2.41.0
next reply other threads:[~2023-08-28 11:19 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-28 11:18 Zoltán Böszörményi [this message]
2023-11-07 11:46 ` [PATCH] Don't add route for invalid dst and gateway address combinations Böszörményi Zoltán
2023-11-08 14:40 ` Marcel Holtmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230828111846.2170668-1-zboszor@gmail.com \
--to=zboszor@gmail.com \
--cc=connman@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).