[PATCH net 0/2] ipv6: rpl: fix loop detection for separated local addresses

[PATCH net 0/2] ipv6: rpl: fix loop detection for separated local addresses

[Mark Amirkan via B4 Relay]

ipv6_chk_rpl_srh_loop() misses the shortest RPL loop pattern containing
two local addresses with a non-local address between them. The check is
made before the current local address is counted, so found is 1 rather
than greater than 1 when the second local address is reached.

Patch 1 fixes the condition. Patch 2 adds a selftest which verifies that
adjacent local addresses are accepted and separated local addresses are
rejected.

The selftest fails on the unmodified net tree and passes with the fix.

Signed-off-by: Mark Amirkan <markdamirkan@gmail.com>
---
Mark Amirkan (2):
      ipv6: rpl: fix loop detection for separated local addresses
      selftests: net: add RPL SRH loop test

 net/ipv6/addrconf.c                         |  2 +-
 tools/testing/selftests/net/Makefile        |  1 +
 tools/testing/selftests/net/rpl_srh_loop.sh | 38 +++++++++++++++++++++++++++++
 3 files changed, 40 insertions(+), 1 deletion(-)
---
base-commit: 78445023439506ebd83b86d40b1e428a3b309d4a
change-id: 20260911-sympwn-rpl-send-c739b4c864a7

Best regards,
--  
Mark Amirkan <markdamirkan@gmail.com>

[PATCH net 1/2] ipv6: rpl: fix loop detection for separated local addresses

[Mark Amirkan via B4 Relay]

From: Mark Amirkan <markdamirkan@gmail.com>

RFC 6554 requires an RPL router to drop a packet when two or more
addresses assigned to the router are separated in the SRH by an address
not assigned to it.

ipv6_chk_rpl_srh_loop() checks found > 1 before counting the current
local address. For the shortest invalid sequence -- local, non-local,
local -- found is 1 at the second local address and the SRH is accepted.

Check whether a local address was seen before the separation instead.
The receive path calls this helper before forwarding an RPL SRH, and
RFC 6554 requires the check to mitigate bandwidth-exhaustion attacks.

Fixes: f37c60593634 ("addrconf: add functionality to check on rpl requirements")
Cc: stable@vger.kernel.org
Signed-off-by: Mark Amirkan <markdamirkan@gmail.com>
Assisted-by: Symbolic
---
 net/ipv6/addrconf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 9d89be7e0544..f678fb7fa574 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4621,7 +4621,7 @@ int ipv6_chk_rpl_srh_loop(struct net *net, const struct in6_addr *segs,
 		}
 
 		if (hash_found) {
-			if (found > 1 && separated) {
+			if (found && separated) {
 				ret = 1;
 				break;
 			}

-- 
2.43.0

[PATCH net 2/2] selftests: net: add RPL SRH loop test

[Mark Amirkan via B4 Relay]

From: Mark Amirkan <markdamirkan@gmail.com>

Add two local addresses to a network namespace and exercise RPL route
validation. Verify that adjacent local addresses remain valid, while a
non-local address between them causes the route to be rejected.

Signed-off-by: Mark Amirkan <markdamirkan@gmail.com>
Assisted-by: Symbolic
---
 tools/testing/selftests/net/Makefile        |  1 +
 tools/testing/selftests/net/rpl_srh_loop.sh | 38 +++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index 3ee3378f8b26..7fe7e38b9c6c 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -80,6 +80,7 @@ TEST_PROGS := \
 	reuseport_addr_any.sh \
 	route_hint.sh \
 	route_localnet.sh \
+	rpl_srh_loop.sh \
 	rps_default_mask.sh \
 	rtnetlink.py \
 	rtnetlink.sh \
diff --git a/tools/testing/selftests/net/rpl_srh_loop.sh b/tools/testing/selftests/net/rpl_srh_loop.sh
new file mode 100755
index 000000000000..a2e9991d789d
--- /dev/null
+++ b/tools/testing/selftests/net/rpl_srh_loop.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+source lib.sh
+
+cleanup()
+{
+	cleanup_ns "$NS"
+}
+
+trap cleanup EXIT
+
+require_command ip
+setup_ns NS || exit $?
+
+ip -n "$NS" -6 address add 2001:db8:1::1/128 dev lo nodad
+ip -n "$NS" -6 address add 2001:db8:3::1/128 dev lo nodad
+
+if ! ip -n "$NS" -6 route add 2001:db8:10::/64 \
+	encap rpl segs 2001:db8:4::1 dev lo 2>/dev/null; then
+	echo "SKIP: RPL lightweight tunnel support not available"
+	exit $ksft_skip
+fi
+
+RET=0
+ip -n "$NS" -6 route add 2001:db8:11::/64 \
+	encap rpl segs 2001:db8:1::1,2001:db8:3::1 dev lo
+check_err $? "Adjacent local addresses were rejected"
+log_test "RPL accepts adjacent local addresses"
+
+RET=0
+ip -n "$NS" -6 route add 2001:db8:12::/64 \
+	encap rpl segs 2001:db8:1::1,2001:db8:2::1,2001:db8:3::1 dev lo \
+	2>/dev/null
+check_fail $? "Separated local addresses were accepted"
+log_test "RPL rejects separated local addresses"
+
+exit $EXIT_STATUS

-- 
2.43.0