From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f52.google.com (mail-wr1-f52.google.com [209.85.221.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 42EC63D170C for ; Mon, 20 Jul 2026 09:14:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784538895; cv=none; b=nITW0BrPeN3wFzuKAXM7wYRrhD+fcx59N0BZUXAqJ5Onz/R7GKcfRq3ytkUD6iaLY6cky4A4XOCr2FLS2c0EVk6rrvw1wCc1Db4CI0YaaOmzTN9DRKgUUlhnSLK3st6pbJZsKgWKprc2HpRRjzJZuX53gqNl1QnhLSI0/rTh/8E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784538895; c=relaxed/simple; bh=n0cYgeO7AYelPNLANCH9y/hwheUejDo61R1XtpNA9/k=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Y4rpO0PAXq4G/is6cKNzXxDJXwQAZ5gOYqx8WcvTPLitTRCuPtXeIi8KwAY7lvpuI3HDV2Y0J8OyTrj0+OPI77cs+Fa7w7ez7qkXFSNYZ8tndlf+nn8KHwY7s6yE+9NpVCRL40Fj5revT4feQdYukNcKgrdBX9hvuEUjTZPT2d8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=blackwall.org; spf=none smtp.mailfrom=blackwall.org; dkim=pass (2048-bit key) header.d=blackwall.org header.i=@blackwall.org header.b=KzDO169s; arc=none smtp.client-ip=209.85.221.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=blackwall.org Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=blackwall.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=blackwall.org header.i=@blackwall.org header.b="KzDO169s" Received: by mail-wr1-f52.google.com with SMTP id ffacd0b85a97d-47362928f65so8931173f8f.2 for ; Mon, 20 Jul 2026 02:14:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=blackwall.org; s=google; t=1784538892; x=1785143692; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:from:references :cc:to:content-language:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=qYe/cwTmtSYCyBAS9PJyu1+mCd/R/Mo9vdMOvvfakiE=; b=KzDO169sEfwOeytGE1Ra47AQfDmFXaFzf2h2IVGppYlddMIQJ1aZzwL+jewQnlHNLB x/8cg9qW3T0Pag4yrQNoHKuzorgonA/hn072Ni/n/ZbW0gLrDritj3pzt5Sq/w2Lzl4Z fFdJNnPEnkM8BQsNeSouSFo51CvREeiug2l8GuXSg5rh3+fEGEvp8Pmo+KaSQ9q4sSI0 1fsg7MA66yk5Zbmfyim9GEKOabt6GcZGZT9QyKZYQreg7/syAULum9hIHujUUBTFygWv 0HpYNdyNxxT3W4GqK02YrNsM4Y/6yfI40QqtpW0zo3rYppv2EF5UJI170RyagXZxLOis OyJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784538892; x=1785143692; h=content-transfer-encoding:content-type:in-reply-to:from:references :cc:to:content-language:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=qYe/cwTmtSYCyBAS9PJyu1+mCd/R/Mo9vdMOvvfakiE=; b=jgLNIW89bcSH8W2Q2iJEC6ANJH7y0gu434L2R/wiyj9obHhbntvzjqie2e0LOb1Zo+ gmM6x4jduRzYynp0utNlP512E5VXuD6CS/X9Bgt+vk0wpl4hjiPGZKVah8FnK027Q50S qRwokyuUrLWc/JAZbsuH28BEDAlHBaKCD0iiWJTDlfvkaj6vZvGSTH1yIy8zPNxOlvPM AOIgtDyMOqCiyYNfdWgwC6gxcnppkAfGA+STRIDUFy5h1mDxKXUOdu2BwKCBORJ2RcpP j9EpVgj7gx0GKNIyH2tZuwZKPTF1lAhk+ugJGdZe0EBC0a/kMtmE8Nf5vsztkzdjx+D1 r1eg== X-Forwarded-Encrypted: i=1; AHgh+RpswxsFThVKppnXFsylN5PUPdMzufkPsmdsriEElGUQ4GepA0+j4JMQBKmrHvdVnxvVMzLmOYb2w+B7138=@vger.kernel.org X-Gm-Message-State: AOJu0YxWgSMd6+x7v/KAlFvGW7Y7YxAso/Ml/Xkmn9Fy1wbJ4oI2J77L UKlqcCF3Wk+8axqTGE2uQYmXibNvI4X96uk2SqS7InEaUHzMy8v2v1ULjiB65QNNKX4= X-Gm-Gg: AfdE7ckgAPwQpw1ZBjeuS66WKh7i4PVQnhJ8PEM2samP3K5GGNQ4mddyBkPEBNTuKG8 dC88zW53F89N7Gc4JQBevrsyrEcmr3Q08otAMC1aEg0Y6NIDC33fe6+AF8cnVLAXJKyV0i+oK63 FaTcUWJhxEnOULX7Z7MVbxeK51p6UaRb0whXsgUymzlAHoXkTKejimEb4Hq2g2wdJE/3INpC6uM IAth/8dYEJAWrCS853tFG8F1M8rwLVQqcXrF3/oKszDPezdhC4oYh8Jf62spW6lZ9Cc/U8Uq6YN laEgV5+vVToXA6tSibCpDiMwYdwntu0rom+x9cn4HjxFawlRaXOikGQjailgwHWgOMFUauxzf8H GndavOl4RaKMO4XU6oRW61TqQJIBjVJmlE7HC94yV5GGsmmFW+n9nN2soGD+h5w5nc07Fh0O7HP XJY0hO0CPL6/9t4ltL5FfzrZKcsN7KE3jC X-Received: by 2002:a05:6000:4b01:b0:47d:ee9d:90c8 with SMTP id ffacd0b85a97d-47f6230659bmr16136823f8f.3.1784538892521; Mon, 20 Jul 2026 02:14:52 -0700 (PDT) Received: from [192.168.0.161] (78-154-15-182.ip.btc-net.bg. [78.154.15.182]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f67466e09sm29580156f8f.21.2026.07.20.02.14.51 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 20 Jul 2026 02:14:51 -0700 (PDT) Message-ID: <78f42aa0-70fe-475a-ab2b-eff062a629db@blackwall.org> Date: Mon, 20 Jul 2026 12:14:50 +0300 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH net-next 3/5] bridge: Validate NS/NA messages using ndisc_check_ns_na() Content-Language: en-US, bg To: Danielle Ratson , netdev@vger.kernel.org Cc: dsahern@kernel.org, idosch@nvidia.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, ja@ssi.bg, petrm@nvidia.com, fw@strlen.de, kuniyu@google.com, bridge@lists.linux.dev, linux-kernel@vger.kernel.org References: <63efa708b4b0bd9edb3a6f6a521cb5022c43aaa5.1784463131.git.danieller@nvidia.com> From: Nikolay Aleksandrov In-Reply-To: <63efa708b4b0bd9edb3a6f6a521cb5022c43aaa5.1784463131.git.danieller@nvidia.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 19/07/2026 16:34, Danielle Ratson wrote: > The bridge performs neighbor suppression by snooping NS/NA messages, but > previously only checked the ICMPv6 type and code. This leaves it open to > acting on malformed or spoofed packets that any RFC-compliant node should > reject. > > Wire br_is_nd_neigh_msg() into the new ndisc_check_ns_na() helper, which > enforces the full RFC 4861 section 7.1.1/7.1.2 receive validation: > hop limit of 255, valid checksum, correct code, and type-specific rules > (NS target not multicast; NA solicited flag clear for multicast > destinations). > > MLD messages are already validated by ipv6_mc_check_mld() before the > bridge acts on them; this brings NS/NA to the same standard. > > As a side effect, the skb parameter of br_is_nd_neigh_msg() changes from > const to non-const, since ndisc_check_ns_na() may reallocate the skb head > via pskb_may_pull() and sets the transport header. The returned pointer is > now derived from skb_transport_header() rather than a direct cast. > > Reviewed-by: Petr Machata > Signed-off-by: Danielle Ratson > --- > net/bridge/br_arp_nd_proxy.c | 11 ++++------- > net/bridge/br_private.h | 2 +- > 2 files changed, 5 insertions(+), 8 deletions(-) > Acked-by: Nikolay Aleksandrov