Re: [PATCH net-next v4 4/6] netlink: specs: rt-route: describe lwtunnel IP options

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] netlink: YNL geneve requests unconditionally rejected due to missing NLA_F_NESTED
--

commit bb8425fa89209355072145c90ad72e3379375b6e
Author: Hangbin Liu <liuhangbin@kylinos.cn>

netlink: specs: rt-route: describe lwtunnel IP options

Replace binary opts in lwtunnel-ip and lwtunnel-ip6 with a nested
lwtunnel-ip-opts set. Add attribute sets for geneve, vxlan, and erspan
IP options to match linux/lwtunnel.h.

> diff --git a/Documentation/netlink/specs/rt-route.yaml b/Documentation/netlink/specs/rt-route.yaml
> index dc842a786794a..ea6711292c9b6 100644
> --- a/Documentation/netlink/specs/rt-route.yaml
> +++ b/Documentation/netlink/specs/rt-route.yaml
[ ... ]
> @@ -562,6 +564,45 @@ attribute-sets:
>        -
>          name: link
>          type: u32
> +  -
> +    name: lwtunnel-ip-opts
> +    name-prefix: lwtunnel-ip-opts-
> +    attributes:
> +      -
> +        name: geneve
> +        type: binary

[Severity: Medium]
Even though the commit message mentions using binary for Geneve options as a
temporary workaround, will this unconditionally break the request path for YNL
clients?

Because geneve is defined here as type binary, a YNL client will format the
attribute without the NLA_F_NESTED flag. However, the kernel's
ip_opts_policy in net/ipv4/ip_tunnel_core.c strictly defines this attribute
as nested:

    [LWTUNNEL_IP_OPTS_GENEVE] = { .type = NLA_NESTED },

When ip_tun_parse_opts() calls nla_validate() with strict validation,
__nla_validate_parse() in lib/nlattr.c rejects the attribute if the
NLA_F_NESTED flag is missing:

    if ((pt->type == NLA_NESTED || pt->type == NLA_NESTED_ARRAY) &&
        !(nla->nla_type & NLA_F_NESTED)) {
            NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt,
                                    "NLA_F_NESTED is missing");
            return -EINVAL;
    }

Additionally, without multi-attr: true, YNL cannot express multiple
consecutive Geneve options which the kernel expects.

> +      -
> +        name: vxlan
> +        type: nest
> +        nested-attributes: lwtunnel-ip-opt-vxlan
> +      -
> +        name: erspan
> +        type: nest
> +        nested-attributes: lwtunnel-ip-opt-erspan
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008-ynl_rt_encap-v4-0-4ed2ccf7f949@kylinos.cn?part=4