Re: [PATCH net] ipv4: fib: treat an unbuildable encapsulation as a nexthop mismatch

[Gabriel Goller <g.goller@proxmox.com>]

On 20.09.2026 12:08, Ido Schimmel wrote:
> On Fri, Sep 18, 2026 at 05:28:33PM +0200, Gabriel Goller wrote:
> > fib_encap_match() builds the requested lwtunnel state and compares it
> > against the nexthop of a candidate route. When lwtunnel_build_state()
> > failed it left result at 0, which is interpreted as "the nexthop
> > matches", so fib_nh_match() continues to compare only oif and gateway.
> > 
> > So if there comes along a RTM_DELROUTE which carries an encapsulation
> > the kernel rejects, it could delete a different route with a different
> > encapsulation.
> 
> Did you hit this in practice? Can you share details?

Nope, found this in the code while writing
https://lore.kernel.org/netdev/arD-5t6LiBiPXAAa@luna.proxmox.com/

> Note that the modern alternative is to install nexthop objects with
> encapsulation and then associate these objects with routes.

Yep.

> > Fixes: 571e722676fe ("ipv4: support for fib route lwtunnel encap attributes")
> > Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
> > ---
> >  net/ipv4/fib_semantics.c | 14 +++++++-------
> >  1 file changed, 7 insertions(+), 7 deletions(-)
> > 
> > diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
> > index 50e96f86ca59..951e48ae87da 100644
> > --- a/net/ipv4/fib_semantics.c
> > +++ b/net/ipv4/fib_semantics.c
> > @@ -911,17 +911,17 @@ static int fib_encap_match(struct net *net, u16 encap_type,
> >  			   struct netlink_ext_ack *extack)
> >  {
> >  	struct lwtunnel_state *lwtstate;
> > -	int ret, result = 0;
> > +	int result;
> >  
> >  	if (encap_type == LWTUNNEL_ENCAP_NONE)
> >  		return 0;
> 
> This is also "unbuildable", but will match.
> 
> lwtunnel_build_state() returns an error in this case, so you can just
> remove this check.

Makes sense, will send a v2 soon.

Thanks for the review!
Gabriel


> > -	ret = lwtunnel_build_state(net, encap_type, encap, AF_INET,
> > -				   cfg, &lwtstate, extack);
> > -	if (!ret) {
> > -		result = lwtunnel_cmp_encap(lwtstate, nh->fib_nh_lws);
> > -		lwtstate_free(lwtstate);
> > -	}
> > +	if (lwtunnel_build_state(net, encap_type, encap, AF_INET, cfg,
> > +				 &lwtstate, extack))
> > +		return 1;
> > +
> > +	result = lwtunnel_cmp_encap(lwtstate, nh->fib_nh_lws);
> > +	lwtstate_free(lwtstate);
> >  
> >  	return result;
> >  }