bridge: Validate and clean up IPv6 neighbour suppression
Status from this message: This series was applied to netdev/net-next.git (main)
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v2 Latest5 patches 4 repliesApplied 5/5
- v15 patches 11 repliesSuperseded
Changes in v2 from the cover letter
* Patches #2,#5:
* Use EXPORT_SYMBOL_GPL() instead of EXPORT_SYMBOL() to export ndisc_check_ns_na().
* Patch #4:
* Add a comment noting that br_is_nd_neigh_msg() also linearizes the skb.
Patches in v2 All 5 applied
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/5 | bridge: Use direct pointer in br_is_nd_neigh_msg()net/ net/ net/ +1 more | +7 | 1 reply | Applied |
| 2/5 | ipv6: ndisc: Add ndisc_check_ns_na() validation helperinclude/ net/ net/ | +193 | 1 reply | Applied |
| 3/5 | bridge: Validate NS/NA messages using ndisc_check_ns_na()net/ net/ | +5 | 0 replies | Applied |
| 4/5 | bridge: Linearize skb once the ND message type is validatednet/ | +8 | 1 reply | Applied |
| 5/5 | bridge: Use ndisc_parse_options() to parse ND options in br_nd_send()net/ net/ | +18 | 1 reply | Applied |
Reviews trailers per patch
All 5 patches have a Reviewed-by or Acked-by.
| Patch | Petr Machata | Nikolay Aleksandrov |
|---|---|---|
| 1/5 | R-b | A-b |
| 2/5 | R-b | A-b |
| 3/5 | R-b | A-b |
| 4/5 | R-b | A-b |
| 5/5 | R-b | A-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH net-next v2 0/5] bridge: Validate and clean up IPv6 neighbour suppression
The bridge implements IPv6 neighbour suppression by snooping Neighbour Solicitation and Neighbour Advertisement messages, but it previously only checked the ICMPv6 type and code before acting on them. This leaves it open to acting on malformed or spoofed packets that any RFC 4861 compliant node should reject, and the option parsing in br_nd_send() open-codes a loop that has historically been a source of bugs.
This series hardens and cleans up that path:
Add ndisc_check_ns_na(), a standalone NS/NA validator modeled after ipv6_mc_check_mld(), implementing the RFC 4861 section 7.1.1 / 7.1.2 mandatory receive checks (hop limit, checksum, code, length, target and option validation). Wire the bridge into it so NS/NA messages are validated to the same standard MLD already enjoys.
Replace the manual ND option parsing loop in br_nd_send() with ndisc_parse_options() and ndisc_opt_addr_data(), and linearize the skb once it has been validated as an NS/NA message so that this and any future ND message handling operate on a linear buffer. The first patch is a small preparatory cleanup that drops the now-unnecessary skb_header_pointer() fallback from br_is_nd_neigh_msg().
No functional change is intended for well-formed packets.
Patchset overview:
Patch #1: drop the skb_header_pointer() fallback. Patches #2-#3: add ndisc_check_ns_na() and validate NS/NA with it. Patch #4: linearize once the ND message type is validated. Patch #5: parse options via ndisc_parse_options().
v2:
* Patches #2,#5:
* Use EXPORT_SYMBOL_GPL() instead of EXPORT_SYMBOL() to export ndisc_check_ns_na().
* Patch #4:
* Add a comment noting that br_is_nd_neigh_msg() also linearizes the skb.
Danielle Ratson (5):
bridge: Use direct pointer in br_is_nd_neigh_msg()
ipv6: ndisc: Add ndisc_check_ns_na() validation helper
bridge: Validate NS/NA messages using ndisc_check_ns_na()
bridge: Linearize skb once the ND message type is validated
bridge: Use ndisc_parse_options() to parse ND options in br_nd_send()
include/net/ndisc.h | 2 + net/bridge/br_arp_nd_proxy.c | 57 ++++++----- net/bridge/br_device.c | 4 +- net/bridge/br_input.c | 4 +- net/bridge/br_private.h | 2 +- net/ipv6/Makefile | 2 +- net/ipv6/ndisc.c | 1 + net/ipv6/ndisc_snoop.c | 190 +++++++++++++++++++++++++++++++++++ 8 files changed, 227 insertions(+), 35 deletions(-) create mode 100644 net/ipv6/ndisc_snoop.c
Signature · 1 line
2.54.0