[PATCH v2 0/5] fib: fix full table overwrite on address wraparound

[Robert Sanford]

From: Robert Sanford <rsanford at akamai.com>

Both FIB dataplanes can overwrite their entire lookup table when a
prefix whose range ends at the top of the address space is added,
deleted, or has its next hop changed, while more-specific routes cover
its range up to that point. The call returns 0, so the corruption is
silent.

One real-world trigger is a default route coexisting with explicit /1
routes: with 0.0.0.0/0, 0.0.0.0/1 and 128.0.0.0/1 installed, deleting
0.0.0.0/0 makes every lookup miss. IPv6 behaves the same with ::/0,
::/1 and 8000::/1.

In modify_fib() (dir24_8.c) and modify_dp() (trie.c), the branch that
skips a route starting exactly at the current left edge has no
wraparound check, while the branch that installs a gap does. Patches 2
and 3 add the missing check. Patches 4 and 5 add unit tests that fail
without the fixes and pass with them.

Patch 1 fixes undefined behavior in rte_rib.c that the new IPv4 test
reaches: its bit test computes 1 << 31 on a signed int for nodes at
depth 0. No existing test adds a depth-0 route.

v2:
- Add patch 1. The CI UBSan build reported the undefined behavior in
  rte_rib.c when running the v1 test/fib wraparound test.
- Patches 2-5 are unchanged from v1.

Robert Sanford (5):
  rib: fix undefined behavior in bit test
  fib: fix full table overwrite on address wraparound
  fib6: fix full table overwrite on address wraparound
  test/fib: reproduce table overwrite on address wraparound
  test/fib6: reproduce table overwrite on address wraparound

 app/test/test_fib.c  |  94 +++++++++++++++++++++++++++++++++++++++
 app/test/test_fib6.c | 103 +++++++++++++++++++++++++++++++++++++++++++
 lib/fib/dir24_8.c    |   6 +++
 lib/fib/trie.c       |   6 +++
 lib/rib/rte_rib.c    |   8 ++--
 5 files changed, 213 insertions(+), 4 deletions(-)

-- 
2.34.1