[PATCH] netlink: Strip nexthop identifiers when duplicating routes

[Stefano Brivio <sbrivio@redhat.com>]

If routing daemons set up host routes, for example FRR via OSPF as in
the reported issue, they might add nexthop identifiers (not objects)
that are generally not valid in the target namespace. Strip them off
as well, otherwise we'll get EINVAL from the kernel.

Link: https://github.com/containers/podman/issues/22960
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 netlink.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/netlink.c b/netlink.c
index 4dbddb2..58822e9 100644
--- a/netlink.c
+++ b/netlink.c
@@ -608,6 +608,15 @@ int nl_route_dup(int s_src, unsigned int ifi_src,
 				 * route invalid in the namespace.  Strip off
 				 * RTA_PREFSRC attributes to avoid that. */
 				rta->rta_type = RTA_UNSPEC;
+			} else if (rta->rta_type == RTA_NH_ID) {
+				/* Host routes set up via routing protocols
+				 * (e.g. OSPF) might contain a nexthop ID (and
+				 * not nexthop objects, which are taken care of
+				 * in the RTA_MULTIPATH case above) that's not
+				 * valid in the target namespace. Strip those as
+				 * well.
+				 */
+				rta->rta_type = RTA_UNSPEC;
 			}
 		}
 
-- 
@@ -608,6 +608,15 @@ int nl_route_dup(int s_src, unsigned int ifi_src,
 				 * route invalid in the namespace.  Strip off
 				 * RTA_PREFSRC attributes to avoid that. */
 				rta->rta_type = RTA_UNSPEC;
+			} else if (rta->rta_type == RTA_NH_ID) {
+				/* Host routes set up via routing protocols
+				 * (e.g. OSPF) might contain a nexthop ID (and
+				 * not nexthop objects, which are taken care of
+				 * in the RTA_MULTIPATH case above) that's not
+				 * valid in the target namespace. Strip those as
+				 * well.
+				 */
+				rta->rta_type = RTA_UNSPEC;
 			}
 		}
 
-- 
2.43.0