[PATCH net 0/2] ipv6: rpl: fix loop detection for separated local addresses

[PATCH net 0/2] ipv6: rpl: fix loop detection for separated local addresses

[Mark Amirkan via B4 Relay]

ipv6_chk_rpl_srh_loop() misses the shortest RPL loop pattern containing
two local addresses with a non-local address between them. The check is
made before the current local address is counted, so found is 1 rather
than greater than 1 when the second local address is reached.

Patch 1 fixes the condition. Patch 2 adds a selftest which verifies that
adjacent local addresses are accepted and separated local addresses are
rejected.

The selftest fails on the unmodified net tree and passes with the fix.

Signed-off-by: Mark Amirkan <markdamirkan@gmail.com>
---
Mark Amirkan (2):
      ipv6: rpl: fix loop detection for separated local addresses
      selftests: net: add RPL SRH loop test

 net/ipv6/addrconf.c                         |  2 +-
 tools/testing/selftests/net/Makefile        |  1 +
 tools/testing/selftests/net/rpl_srh_loop.sh | 38 +++++++++++++++++++++++++++++
 3 files changed, 40 insertions(+), 1 deletion(-)
---
base-commit: 78445023439506ebd83b86d40b1e428a3b309d4a
change-id: 20260911-sympwn-rpl-send-c739b4c864a7

Best regards,
--  
Mark Amirkan <markdamirkan@gmail.com>

[PATCH net 1/2] ipv6: rpl: fix loop detection for separated local addresses

[Mark Amirkan via B4 Relay]

From: Mark Amirkan <markdamirkan@gmail.com>

RFC 6554 requires an RPL router to drop a packet when two or more
addresses assigned to the router are separated in the SRH by an address
not assigned to it.

ipv6_chk_rpl_srh_loop() checks found > 1 before counting the current
local address. For the shortest invalid sequence -- local, non-local,
local -- found is 1 at the second local address and the SRH is accepted.

Check whether a local address was seen before the separation instead.
The receive path calls this helper before forwarding an RPL SRH, and
RFC 6554 requires the check to mitigate bandwidth-exhaustion attacks.

Fixes: f37c60593634 ("addrconf: add functionality to check on rpl requirements")
Cc: stable@vger.kernel.org
Signed-off-by: Mark Amirkan <markdamirkan@gmail.com>
Assisted-by: Symbolic
---
 net/ipv6/addrconf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 9d89be7e0544..f678fb7fa574 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4621,7 +4621,7 @@ int ipv6_chk_rpl_srh_loop(struct net *net, const struct in6_addr *segs,
 		}
 
 		if (hash_found) {
-			if (found > 1 && separated) {
+			if (found && separated) {
 				ret = 1;
 				break;
 			}

-- 
2.43.0

[PATCH net 2/2] selftests: net: add RPL SRH loop test

[Mark Amirkan via B4 Relay]

From: Mark Amirkan <markdamirkan@gmail.com>

Add two local addresses to a network namespace and exercise RPL route
validation. Verify that adjacent local addresses remain valid, while a
non-local address between them causes the route to be rejected.

Signed-off-by: Mark Amirkan <markdamirkan@gmail.com>
Assisted-by: Symbolic
---
 tools/testing/selftests/net/Makefile        |  1 +
 tools/testing/selftests/net/rpl_srh_loop.sh | 38 +++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index 3ee3378f8b26..7fe7e38b9c6c 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -80,6 +80,7 @@ TEST_PROGS := \
 	reuseport_addr_any.sh \
 	route_hint.sh \
 	route_localnet.sh \
+	rpl_srh_loop.sh \
 	rps_default_mask.sh \
 	rtnetlink.py \
 	rtnetlink.sh \
diff --git a/tools/testing/selftests/net/rpl_srh_loop.sh b/tools/testing/selftests/net/rpl_srh_loop.sh
new file mode 100755
index 000000000000..a2e9991d789d
--- /dev/null
+++ b/tools/testing/selftests/net/rpl_srh_loop.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+source lib.sh
+
+cleanup()
+{
+	cleanup_ns "$NS"
+}
+
+trap cleanup EXIT
+
+require_command ip
+setup_ns NS || exit $?
+
+ip -n "$NS" -6 address add 2001:db8:1::1/128 dev lo nodad
+ip -n "$NS" -6 address add 2001:db8:3::1/128 dev lo nodad
+
+if ! ip -n "$NS" -6 route add 2001:db8:10::/64 \
+	encap rpl segs 2001:db8:4::1 dev lo 2>/dev/null; then
+	echo "SKIP: RPL lightweight tunnel support not available"
+	exit $ksft_skip
+fi
+
+RET=0
+ip -n "$NS" -6 route add 2001:db8:11::/64 \
+	encap rpl segs 2001:db8:1::1,2001:db8:3::1 dev lo
+check_err $? "Adjacent local addresses were rejected"
+log_test "RPL accepts adjacent local addresses"
+
+RET=0
+ip -n "$NS" -6 route add 2001:db8:12::/64 \
+	encap rpl segs 2001:db8:1::1,2001:db8:2::1,2001:db8:3::1 dev lo \
+	2>/dev/null
+check_fail $? "Separated local addresses were accepted"
+log_test "RPL rejects separated local addresses"
+
+exit $EXIT_STATUS

-- 
2.43.0

Re: [PATCH net 1/2] ipv6: rpl: fix loop detection for separated local addresses

[Ido Schimmel]

On Fri, Sep 11, 2026 at 04:11:21PM -0700, Mark Amirkan via B4 Relay wrote:
> From: Mark Amirkan <markdamirkan@gmail.com>
> 
> RFC 6554 requires an RPL router to drop a packet when two or more
> addresses assigned to the router are separated in the SRH by an address
> not assigned to it.
> 
> ipv6_chk_rpl_srh_loop() checks found > 1 before counting the current
> local address. For the shortest invalid sequence -- local, non-local,
> local -- found is 1 at the second local address and the SRH is accepted.
> 
> Check whether a local address was seen before the separation instead.
> The receive path calls this helper before forwarding an RPL SRH, and
> RFC 6554 requires the check to mitigate bandwidth-exhaustion attacks.
> 
> Fixes: f37c60593634 ("addrconf: add functionality to check on rpl requirements")
> Cc: stable@vger.kernel.org
> Signed-off-by: Mark Amirkan <markdamirkan@gmail.com>
> Assisted-by: Symbolic

Code looks fine, but your SoB should be the last tag. Also, if
"Symbolic" is an LLM, then please use:

Assisted-by: LLM

See:

https://docs.kernel.org/next/process/coding-assistants.html#attribution
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=816d9992d9ed434ec52cfbd63080d518e535a41b

Re: [PATCH net 2/2] selftests: net: add RPL SRH loop test

[Ido Schimmel]

On Fri, Sep 11, 2026 at 04:11:22PM -0700, Mark Amirkan via B4 Relay wrote:
> From: Mark Amirkan <markdamirkan@gmail.com>
> 
> Add two local addresses to a network namespace and exercise RPL route
> validation. Verify that adjacent local addresses remain valid, while a
> non-local address between them causes the route to be rejected.
> 
> Signed-off-by: Mark Amirkan <markdamirkan@gmail.com>
> Assisted-by: Symbolic

Thanks for the test. Same comment as before regarding the tag.

> ---
>  tools/testing/selftests/net/Makefile        |  1 +
>  tools/testing/selftests/net/rpl_srh_loop.sh | 38 +++++++++++++++++++++++++++++
>  2 files changed, 39 insertions(+)
> 
> diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
> index 3ee3378f8b26..7fe7e38b9c6c 100644
> --- a/tools/testing/selftests/net/Makefile
> +++ b/tools/testing/selftests/net/Makefile
> @@ -80,6 +80,7 @@ TEST_PROGS := \
>  	reuseport_addr_any.sh \
>  	route_hint.sh \
>  	route_localnet.sh \
> +	rpl_srh_loop.sh \
>  	rps_default_mask.sh \
>  	rtnetlink.py \
>  	rtnetlink.sh \
> diff --git a/tools/testing/selftests/net/rpl_srh_loop.sh b/tools/testing/selftests/net/rpl_srh_loop.sh
> new file mode 100755
> index 000000000000..a2e9991d789d
> --- /dev/null
> +++ b/tools/testing/selftests/net/rpl_srh_loop.sh
> @@ -0,0 +1,38 @@
> +#!/bin/bash
> +# SPDX-License-Identifier: GPL-2.0
> +
> +source lib.sh
> +
> +cleanup()
> +{
> +	cleanup_ns "$NS"
> +}
> +
> +trap cleanup EXIT

This can be:

trap 'cleanup_ns $NS' EXIT

> +
> +require_command ip
> +setup_ns NS || exit $?
> +
> +ip -n "$NS" -6 address add 2001:db8:1::1/128 dev lo nodad
> +ip -n "$NS" -6 address add 2001:db8:3::1/128 dev lo nodad
> +
> +if ! ip -n "$NS" -6 route add 2001:db8:10::/64 \
> +	encap rpl segs 2001:db8:4::1 dev lo 2>/dev/null; then
> +	echo "SKIP: RPL lightweight tunnel support not available"
> +	exit $ksft_skip
> +fi

This can be removed. rpl is present in iproute2 since 2020 and
CONFIG_IPV6_RPL_LWTUNNEL=y is present in tools/testing/selftests/net/config

> +
> +RET=0
> +ip -n "$NS" -6 route add 2001:db8:11::/64 \
> +	encap rpl segs 2001:db8:1::1,2001:db8:3::1 dev lo
> +check_err $? "Adjacent local addresses were rejected"
> +log_test "RPL accepts adjacent local addresses"
> +
> +RET=0
> +ip -n "$NS" -6 route add 2001:db8:12::/64 \
> +	encap rpl segs 2001:db8:1::1,2001:db8:2::1,2001:db8:3::1 dev lo \
> +	2>/dev/null
> +check_fail $? "Separated local addresses were accepted"
> +log_test "RPL rejects separated local addresses"
> +
> +exit $EXIT_STATUS

Should be:

exit "$EXIT_STATUS"

Please run shellcheck. Preferably via ingest_mdir.py:

https://github.com/linux-netdev/nipa#running-locally

Re: [PATCH net 2/2] selftests: net: add RPL SRH loop test

[netdev-bot+sashiko]

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider:

Critical: 0 · High: 0 · Medium: 1 · Low: 0

- [Medium] In tools/testing/selftests/net/rpl_srh_loop.sh the two `ip -6
  address add` commands (lines 16-17) that install the local addresses…

--

selftests: net: add RPL SRH loop test

This adds a new shell test that installs two local addresses in a network
namespace and then adds RPL encap routes to check that adjacent local
segments are accepted while a non-local segment between two local ones is
rejected. The script is registered in TEST_PROGS in the net selftests
Makefile.

> diff --git a/tools/testing/selftests/net/rpl_srh_loop.sh b/tools/testing/selftests/net/rpl_srh_loop.sh
> new file mode 100755
> index 0000000000000..a2e9991d789d6
> --- /dev/null
> +++ b/tools/testing/selftests/net/rpl_srh_loop.sh
> @@ -0,0 +1,38 @@
> +#!/bin/bash
> +# SPDX-License-Identifier: GPL-2.0
> +
> +source lib.sh
> +
> +cleanup()
> +{
> +	cleanup_ns "$NS"
> +}
> +
> +trap cleanup EXIT
> +
> +require_command ip
> +setup_ns NS || exit $?
> +
> +ip -n "$NS" -6 address add 2001:db8:1::1/128 dev lo nodad
> +ip -n "$NS" -6 address add 2001:db8:3::1/128 dev lo nodad

[Severity: Medium]
Should these two address adds be checked?  The script has no set -e, no
|| exit and no check_err on them, and everything the test asserts depends
on both addresses being present.

If either add fails, does the rest of the script still notice?  The
support probe below uses a single segment:

  ip -n "$NS" -6 route add 2001:db8:10::/64 \
	encap rpl segs 2001:db8:4::1 dev lo 2>/dev/null

and in ipv6_chk_rpl_srh_loop() (net/ipv6/addrconf.c) a single iteration
can never reach the failure branch, because found starts at 0:

	if (hash_found) {
		if (found && separated) {
			ret = 1;
			break;
		}

		separated = false;
		found++;
	} else {
		separated = true;
	}

So the probe returns 0 whether or not any local address was installed.

> +
> +if ! ip -n "$NS" -6 route add 2001:db8:10::/64 \
> +	encap rpl segs 2001:db8:4::1 dev lo 2>/dev/null; then
> +	echo "SKIP: RPL lightweight tunnel support not available"
> +	exit $ksft_skip
> +fi
> +
> +RET=0
> +ip -n "$NS" -6 route add 2001:db8:11::/64 \
> +	encap rpl segs 2001:db8:1::1,2001:db8:3::1 dev lo
> +check_err $? "Adjacent local addresses were rejected"
> +log_test "RPL accepts adjacent local addresses"

[Severity: Medium]
Can this subtest pass without exercising the path it describes?  If
2001:db8:1::1 and 2001:db8:3::1 were never installed, both iterations of
ipv6_chk_rpl_srh_loop() take the else branch (separated = true), ret stays
0, the route add succeeds and check_err 0 reports OK.

The same OK result is produced in both the "addresses present" and
"addresses absent" cases, so is there a way for this subtest to
distinguish them?

> +
> +RET=0
> +ip -n "$NS" -6 route add 2001:db8:12::/64 \
> +	encap rpl segs 2001:db8:1::1,2001:db8:2::1,2001:db8:3::1 dev lo \
> +	2>/dev/null
> +check_fail $? "Separated local addresses were accepted"
> +log_test "RPL rejects separated local addresses"

[Severity: Medium]
Does this turn a setup problem into a reported kernel failure?  With no
local addresses installed, none of the three segments hash-match, ret
stays 0 in ipv6_chk_rpl_srh_loop(), the route add succeeds, and then:

  check_fail 0
    -> check_err $((!0))
      -> ret_set_ksft_status $ksft_fail "Separated local addresses were accepted"

log_test folds that into EXIT_STATUS and the script exits 1, so a
namespace where the address adds did not take effect is reported as a
failing kernel test rather than a skip or a setup error.

Since stderr of this route add is discarded with 2>/dev/null and the
address adds are unchecked, is there anything printed that would point at
the real cause?  A partial failure, where only one of the two addresses is
installed, gives the same inverted result.

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260911-sympwn-rpl-send-v1-0-1753993bb584%40gmail.com