From: Timo Teräs <timo.teras@iki.fi>
Date: Thu, 23 Aug 2012 10:29:50 +0000 (+0300)
Subject: packet: fix indefinite looping with bad routes
X-Git-Url: http://opennhrp.git.sourceforge.net/git/gitweb.cgi?p=opennhrp%2Fopennhrp;a=commitdiff_plain;h=515a64f6c570761876f14f97c8eb206e950ee603

packet: fix indefinite looping with bad routes

If there's cycling routing, or just a route with gateway that would
match the route itself, we could end up looping indefinitely. Add
a fixed limit for route lookup recursion.
---

diff --git a/nhrp/nhrp_packet.c b/nhrp/nhrp_packet.c
index f46b481..12dcf3c 100644
--- a/nhrp/nhrp_packet.c
+++ b/nhrp/nhrp_packet.c
@@ -979,7 +979,7 @@ int nhrp_packet_route(struct nhrp_packet *packet)
 	struct nhrp_payload *payload;
 	struct nhrp_peer *peer;
 	char tmp[64];
-	int r;
+	int i, r;
 
 	if (packet->dst_iface == NULL) {
 		nhrp_error("nhrp_packet_route called without destination interface");
@@ -1005,7 +1005,7 @@ int nhrp_packet_route(struct nhrp_packet *packet)
 		proto_nexthop = packet->dst_peer->next_hop_address;
 	} else {
 		proto_nexthop = *dst;
-		do {
+		for (i = 0; i < 4; i++) {
 			peer = nhrp_peer_route_full(
 				packet->dst_iface, &proto_nexthop, 0,
 				NHRP_PEER_TYPEMASK_ROUTE_VIA_NHS, src, cielist);
@@ -1020,7 +1020,12 @@ int nhrp_packet_route(struct nhrp_packet *packet)
 			if (peer->next_hop_address.type == AF_UNSPEC)
 				break;
 			proto_nexthop = peer->next_hop_address;
-		} while (1);
+		}
+		if (i >= 4) {
+			nhrp_error("Recursive routing for protocol address %s",
+				   nhrp_address_format(dst, sizeof(tmp), tmp));
+			return FALSE;
+		}
 
 		packet->dst_peer = nhrp_peer_get(peer);
 	}