[lwip-devel] Bug in ip_route() ?

[Christian Sasso]

Hi,

I'm Christian Sasso and about 4 months ago I started using LwIP on an
embedded project.

Yesterday I realized that ip_route() can return a non-NULL pointer to
an interface that is up, but doesn't belong to any IPv4 subnet.
In fact, when an interface netif doesn't belong to any IPv4 subnet
both netif->netmask and netif->ip_addr are always zero, causing the
condition
    (ip_addr_netcmp(dest, &(netif->ip_addr), &(netif->netmask)))
to always be true irrespective of the value of dest (the destination address.)

This happened to me with a 6lowpan interface that is IPv6 only: it was
returned by ip_route() and later an attempt was made to call
netif->output() on it.
I wrote a patch to fix the issue that simply requires netif->ip_addr
to be non-zero when LWIP_IPV6 is enable, and so far it seems to work
as expected:

diff --git a/production/sw/tps/lwip/lwip/src/core/ipv4/ip4.c
b/production/sw/tps/lwip/lwip/src/core/ipv4/ip4.c
index 322a3d4..fc139a2 100644
--- a/production/sw/tps/lwip/lwip/src/core/ipv4/ip4.c
+++ b/production/sw/tps/lwip/lwip/src/core/ipv4/ip4.c
@@ -178,14 +178,18 @@ ip_route(ip_addr_t *dest)
   /* iterate through netifs */
   for (netif = netif_list; netif != NULL; netif = netif->next) {
     /* network mask matches? */
-    if (netif_is_up(netif)) {
+    if ((netif_is_up(netif))
+#if LWIP_IPV6
+      && (!ip_addr_isany(&(netif->ip_addr)))
+#endif /* LWIP_IPV6 */
+    ) {
       if (ip_addr_netcmp(dest, &(netif->ip_addr), &(netif->netmask))) {
         /* return netif on which to forward IP packet */
         return netif;
       }
     }
   }
-  if ((netif_default == NULL) || (!netif_is_up(netif_default))) {
+  if ((netif_default == NULL) || (!netif_is_up(netif_default)) ||
(ip_addr_isany(&(netif->ip_addr)))) {
     LWIP_DEBUGF(IP_DEBUG | LWIP_DBG_LEVEL_SERIOUS, ("ip_route: No
route to %"U16_F".%"U16_F".%"U16_F".%"U16_F"\n",
       ip4_addr1_16(dest), ip4_addr2_16(dest), ip4_addr3_16(dest),
ip4_addr4_16(dest)));
     IP_STATS_INC(ip.rterr);

Without this, LwIP crashes on my system trying to execute
netif->output(). Notice that even if there were an interface netif
with a defined IPv4 subnet that satisfies
    (ip_addr_netcmp(dest, &(netif->ip_addr), &(netif->netmask)))
an IPv6 only interface would still risk to be returned from ip_route()
if it happened to come first in netif_list. Is this a known problem,
and if so, is the fix right, or I am missing something important?
Thank you for your attention.

Ciao, Chris