kern/52077: "route add" installs unreachable gateway

[s-yamaguchi%iij.ad.jp@localhost]

>Number:         52077
>Category:       kern
>Synopsis:       "route add" installs unreachable gateway
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Mar 15 09:05:00 +0000 2017
>Originator:     Shoichi Yamaguchi
>Release:        -current
>Organization:
Internet Initiative Japan Inc.
>Environment:
NetBSD netbsd 7.99.66 NetBSD 7.99.66 (GENERIC) #4: Wed Mar 15 15:04:08 JST 2017  root@deskfd:(hidden) amd64
>Description:
the "route add" command install wrong route whose gateway is unreachable if the destination is reachable. And the route whose gateway is directly connected cannot be installed.
I do not know whether this is bug, or not. But, OpenBSD fixed this behavior at the following commit.And, FreeBSD is same behavior as OpenBSD too
 - https://bitbucket.org/braindamaged/openbsd-src/commits/097d8d9ded40b4c7832d2e7e486a7876832445fc

>How-To-Repeat:
netbsd# route show -inet
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use    Mtu Interface
default            192.168.95.1       UG          -        -      -  wm1
127/8              localhost          UGR         -        -  33624  lo0
localhost          lo0                UHl         -        -  33624  lo0
192.168.56/24      link#2             U           -        -      -  wm0
192.168.56.68      link#2             UHl         -        -      -  lo0
192.168.95/24      link#3             U           -        -      -  wm1
192.168.95.105     link#3             UHl         -        -      -  lo0
netbsd# route add -net 192.168.56.192/26 10.0.0.1
add net 192.168.56.192: gateway 10.0.0.1
netbsd# route show -inet
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use    Mtu Interface
default            192.168.95.1       UG          -        -      -  wm1
127/8              localhost          UGR         -        -  33624  lo0
localhost          lo0                UHl         -        -  33624  lo0
192.168.56/24      link#2             U           -        -      -  wm0
192.168.56.68      link#2             UHl         -        -      -  lo0
192.168.56.192/26  10.0.0.1           UG          -        -      -  wm0
192.168.95/24      link#3             U           -        -      -  wm1
192.168.95.105     link#3             UHl         -        -      -  lo0
netbsd# route get 192.168.56.193
   route to: 192.168.56.193
destination: 192.168.56.192
       mask: 255.255.255.192
    gateway: 10.0.0.1
 local addr: 192.168.56.68
  interface: wm0
      flags: <UP,GATEWAY,DONE,STATIC>
 recvpipe  sendpipe  ssthresh  rtt,msec    rttvar  hopcount      mtu     expire
       0         0         0         0         0         0         0         0
>Fix:
diff --git a/sys/net/route.c b/sys/net/route.c
index 1411f54..c99fc6e 100644
--- a/sys/net/route.c
+++ b/sys/net/route.c
@@ -1026,11 +1026,15 @@ ifa_ifwithroute_psref(int flags, const struct sockaddr *dst,

                /* XXX we cannot call rtalloc1 if holding the rt lock */
                if (RT_LOCKED())
-                       rt = rtalloc1_locked(dst, 0, true);
+                       rt = rtalloc1_locked(gateway, 0, true);
                else
-                       rt = rtalloc1(dst, 0);
+                       rt = rtalloc1(gateway, 0);
                if (rt == NULL)
                        return NULL;
+               if (rt->rt_flags & RTF_GATEWAY) {
+                       rt_unref(rt);
+                       return NULL;
+               }
                /*
                 * Just in case. May not need to do this workaround.
                 * Revisit when working on rtentry MP-ification.


----------------------------------------------------------------
Added the RTF_GATEWAY check by looking at the following commit:
 - https://bitbucket.org/braindamaged/openbsd-src/commits/78ba7cb9777cd1540f703219bd6463521f1f138b