[PATCH iproute2 v2 2/2] ip nexthop: use the request size as the limit when adding encap

[Fang Jiabao <kaquoin@163.com>]

ipnh_modify() passes a hardcoded 1024 as the size limit to addraw_l()
when it adds the encap attribute, and ignores the return value. Every
other attribute in this function is bounded by sizeof(req). If the encap
attribute does not fit, for example a seg6 encap with 59 segments,
addraw_l() prints "addraw_l ERROR: message exceeded bound of 1024" and
returns -1, but ip sends the request without the encap attribute and
exits with status 0. A nexthop without encap is then installed silently.

Use sizeof(req) as the limit, like the other attributes, and return an
error if addraw_l() fails instead of sending an incomplete request.

Fixes: 63df8e8543b0 ("Add support for nexthop objects")
Assisted-by: Claude:claude-sonnet-5-5
Signed-off-by: Fang Jiabao <kaquoin@163.com>
---
Changes since v1: new patch, the same problem in ip nexthop, as
requested by Stephen Hemminger.

Tested on current main (d95f6650, "man: ip-neighbour.8: document
protocol keyword"), in a network namespace with a dummy device, with:

  ip nexthop add id N via fc00:ee::1 dev d0 encap seg6 mode encap segs <N SIDs>

Before: with 59 segments or more, addraw_l() prints its error, the exit
status is 0 and the nexthop is installed without encap (observed on
e4cd9f1d, the only commit since then changes a man page). After: 58, 59
and 60 segments are added with encap, exit status 0. With 61 and 62
segments "addraw_l ERROR: message exceeded bound of 1048" is printed,
the exit status is 1 and no nexthop is installed.

The request buffer in ipnh_modify() is only 1024 bytes, so sizeof(req)
is barely larger than the old limit. I did not change the buffer size.

 ip/ipnexthop.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/ip/ipnexthop.c b/ip/ipnexthop.c
index ad8ad0c0..ae6a28d4 100644
--- a/ip/ipnexthop.c
+++ b/ip/ipnexthop.c
@@ -1108,10 +1108,10 @@ static int ipnh_modify(int cmd, unsigned int flags, int argc, char **argv)
 			lwt_parse_encap(rta, sizeof(buf), &argc, &argv,
 					NHA_ENCAP, NHA_ENCAP_TYPE);
 
-			if (rta->rta_len > RTA_LENGTH(0)) {
-				addraw_l(&req.n, 1024, RTA_DATA(rta),
-					 RTA_PAYLOAD(rta));
-			}
+			if (rta->rta_len > RTA_LENGTH(0) &&
+			    addraw_l(&req.n, sizeof(req), RTA_DATA(rta),
+				     RTA_PAYLOAD(rta)) < 0)
+				return -1;
 		} else if (!strcmp(*argv, "blackhole")) {
 			addattr_l(&req.n, sizeof(req), NHA_BLACKHOLE, NULL, 0);
 			if (req.nhm.nh_family == AF_UNSPEC)
-- 
2.43.0