lla_rt_output() builds a static LLE from a routing socket message
without checking the sockaddr_dl's sdl_alen. lltable_calc_llheader()
and the if_requestencap() handlers then read if_addrlen bytes from
LLADDR(dl), so a message with a short sdl_alen leaks adjacent bytes of
the (non-zeroed) rtsock buffer into the cached link-layer header, which
for Ethernet is broadcast as the destination MAC of every frame sent to
that entry.
Reject an RTM_ADD whose sdl_alen does not equal the interface address
length, matching the check the netlink neighbor path already performs.
Add a test.
Sponsored by: Advanced Micro Devices, Inc.
Signed-off-by: Osvaldo Janeri Filho <ojanerif@amd.com>