linux-kernel - Re: [PATCH net-next v3] net/ipv6: Introduce accept_unsolicited_na knob to implement router-side changes for RFC9131

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 27 May 2022 13:05:01 +0530
From:   Arun Ajith S <aajith@...sta.com>
To:     David Ahern <dsahern@...nel.org>
Cc:     netdev@...r.kernel.org, davem@...emloft.net,
        linux-kernel@...r.kernel.org, linux-doc@...r.kernel.org,
        yoshfuji@...ux-ipv6.org, kuba@...nel.org, pabeni@...hat.com,
        corbet@....net, prestwoj@...il.com, gilligan@...sta.com,
        noureddine@...sta.com, gk@...sta.com
Subject: Re: [PATCH net-next v3] net/ipv6: Introduce accept_unsolicited_na
 knob to implement router-side changes for RFC9131

On Sat, May 21, 2022 at 7:30 AM David Ahern <dsahern@...nel.org> wrote:
>
> On 5/20/22 1:19 AM, Arun Ajith S wrote:
> > On Thu, Apr 14, 2022 at 3:37 AM David Ahern <dsahern@...nel.org> wrote:
> >>
> >> On 4/13/22 8:34 AM, Arun Ajith S wrote:
> >>> diff --git a/tools/testing/selftests/net/ndisc_unsolicited_na_test.py b/tools/testing/selftests/net/ndisc_unsolicited_na_test.py
> >>> new file mode 100755
> >>> index 000000000000..f508657ee126
> >>> --- /dev/null
> >>> +++ b/tools/testing/selftests/net/ndisc_unsolicited_na_test.py
> >>> @@ -0,0 +1,255 @@
> >>> +#!/bin/bash
> >>
> >> that file name suffix should be .sh since it is a bash script; not .py
> >>
> >> other than that looks good to me.
> >>
> >> Reviewed-by: David Ahern <dsahern@...nel.org>
> >
> > Hi David,
> >
> > It has been pointed out to me that I might have read RFC9131 in a
> > narrower sense than what was intended.
> > The behavior of adding a new entry in the neighbour cache on receiving
> > a NA if none exists presently
> > shouldn't be limited to unsolicited NAs like in my original patch,
> > rather it should extend to all NAs.
> >
> > I am quoting from the RFC below
> >
> >    |  When a valid Neighbor Advertisement is received (either solicited
> >    |  or unsolicited), the Neighbor Cache is searched for the target's
> >    |  entry.  If no entry exists:
> >    |
> >    |  *  Hosts SHOULD silently discard the advertisement.  There is no
> >    |     need to create an entry if none exists, since the recipient has
> >    |     apparently not initiated any communication with the target.
> >    |
> >    |  *  Routers SHOULD create a new entry for the target address with
> >    |     the link-layer address set to the Target Link-Layer Address
> >    |     Option (if supplied).  The entry's reachability state MUST be
> >    |     set to STALE.  If the received Neighbor Advertisement does not
> >    |     contain the Target Link-Layer Address Option, the advertisement
> >    |     SHOULD be silently discarded.
> >
> > I want to fix this, but this would mean the sysctl name
> > accept_unsolicited_na is no longer appropriate
> > I see that the net-next window for 5.19 is still open and changing the
> > sysctl name
> > wouldn't mean changing an existing interface.
> > I was thinking of renaming the sysctl to accept_untracked_na to
> > highlight that we are accepting NAs even if there is
> > no corresponding entry tracked in the neighbor cache.
> >
> > Also, there's an error in my comment, where I say "pass up the stack"
> > as we don't pass NAs up the stack.
> > The comment can be updated as:
> >         /* RFC 9131 updates original Neighbour Discovery RFC 4861.
> >          * NAs with Target LL Address option without a corresponding
> >          * entry in the neighbour cache can now create a STALE neighbour
> >          * cache entry on routers.
> >          *
> >          *   entry accept  fwding  solicited        behaviour
> >          * ------- ------  ------  ---------    ----------------------
> >          * present      X       X         0     Set state to STALE
> >          * present      X       X         1     Set state to REACHABLE
> >          *  absent      0       X         X     Do nothing
> >          *  absent      1       0         X     Do nothing
> >          *  absent      1       1         X     Add a new STALE entry
> >          */
> >
> > In summary
> > 1. accept=0 keeps original(5.18) behavior for all cases.
> > 2. accept=1 changes original behavior for entry=asbent, fwding=1 case
> > provided the NA had specified target link-layer address.
> >
> > Please let me know what you think.
> >
>
> Changes can be made until it is in a released kernel to users. This
> feature has many weeks before it hits that level.

Thanks, I have made the proposed changes here:
https://patchwork.kernel.org/project/netdevbpf/patch/20220527073111.14336-1-aajith@arista.com/