Re: [PATCH net-next 2/5] ipv6: ndisc: Add ndisc_check_ns_na() validation helper

[Nikolay Aleksandrov <razor@blackwall.org>]

On 19/07/2026 16:34, Danielle Ratson wrote:
> Add ndisc_check_ns_na(), a standalone NS/NA packet validator modeled
> after ipv6_mc_check_mld(). It performs the RFC 4861 section 7.1.1
> (Neighbor Solicitation) and 7.1.2 (Neighbor Advertisement) mandatory
> checks that are relevant for software operating at the bridge level,
> where packets bypass the normal IPv6 stack path:
> 
>   - Hop Limit must be 255 (packet was not forwarded by a router)
>   - ICMPv6 checksum is valid
>   - ICMP Code is 0
>   - ICMP length is at least 24 octets (sizeof(struct nd_msg))
>   - Target Address must not be a multicast address
>   - All included options have a length that is greater than zero
>   - NS/DAD: destination must be a solicited-node multicast address
>   - NS/DAD: no Source Link-Layer Address option when source is unspecified
>   - NA: Solicited flag must be 0 when IP Destination is multicast
> 
> On success the function sets the skb transport header and returns 0,
> matching the convention of ipv6_mc_check_mld().
> 
> Reviewed-by: Petr Machata <petrm@nvidia.com>
> Signed-off-by: Danielle Ratson <danieller@nvidia.com>
> ---
>   include/net/ndisc.h    |   2 +
>   net/ipv6/Makefile      |   2 +-
>   net/ipv6/ndisc_snoop.c | 190 +++++++++++++++++++++++++++++++++++++++++
>   3 files changed, 193 insertions(+), 1 deletion(-)
>   create mode 100644 net/ipv6/ndisc_snoop.c
> 

Acked-by: Nikolay Aleksandrov <razor@blackwall.org>