bin/40174: ndp: deleting non-exsistent entry may delete cloning route

[tkhr.hash%gmail.com@localhost]

>Number:         40174
>Category:       bin
>Synopsis:       ndp: deleting non-exsistent entry may delete cloning route
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Dec 15 08:20:00 +0000 2008
>Originator:     Takahiro Hayashi
>Release:        NetBSD-current 5.99.5 (Dec 11 2008)
>Organization:
>Environment:
System: NetBSD peer 5.99.5 NetBSD 5.99.5 (PEER) #0: Thu Dec 11 12:41:31 JST 
2008 root@peer:/usr/obj/sys/arch/i386/compile/PEER i386
Architecture: i386
Machine: i386
>Description:
 When adding a address to interface the cloning route is generated
automatically. Using ndp(8) deleteing the entry that is included
in the route and not exist in NDP entries deletes the cloning route.
For example, a interface has ipv6 address fec0::1/64 and fec0::2 is not 
in NDP entries. "ndp -d fec0::2" results in deleting the route fec0::/64 
instead of causing an error (e.g. ESRCH).
 ndp(8) tries to get the route of the host to be deleted before deleting
it. The non-exisitent address may match to the cloning route as needed.
Therefore ndp(8) will delete the cloning route.

>How-To-Repeat:
see description.
>Fix:
The route whose flags has RTF_CLONING should be avoided from the entry
to be deleted. Following patch can achieve it.

Index: usr.sbin/ndp/ndp.c
===================================================================
RCS file: /cvsroot/src/usr.sbin/ndp/ndp.c,v
retrieving revision 1.37
diff -u -r1.37 ndp.c
--- usr.sbin/ndp/ndp.c  16 Jan 2007 17:32:04 -0000      1.37
+++ usr.sbin/ndp/ndp.c  14 Dec 2008 18:05:30 -0000
@@ -498,7 +498,8 @@
        }
 
 delete:
-       if (sdl->sdl_family != AF_LINK) {
+       if (sdl->sdl_family != AF_LINK ||
+           (rtm->rtm_flags & RTF_CLONING)) {
                (void)printf("cannot locate %s\n", host);
                return (1);
        }