[PATCH net-next 0/5] bridge: Validate and clean up IPv6 neighbour suppression

[Danielle Ratson]

The bridge implements IPv6 neighbour suppression by snooping Neighbour
Solicitation and Neighbour Advertisement messages, but it previously only
checked the ICMPv6 type and code before acting on them. This leaves it
open to acting on malformed or spoofed packets that any RFC 4861 compliant
node should reject, and the option parsing in br_nd_send() open-codes a
loop that has historically been a source of bugs.

This series hardens and cleans up that path:

Add ndisc_check_ns_na(), a standalone NS/NA validator modeled after
ipv6_mc_check_mld(), implementing the RFC 4861 section 7.1.1 / 7.1.2
mandatory receive checks (hop limit, checksum, code, length, target and
option validation). Wire the bridge into it so NS/NA messages are
validated to the same standard MLD already enjoys.

Replace the manual ND option parsing loop in br_nd_send() with
ndisc_parse_options() and ndisc_opt_addr_data(), and linearize the skb
once it has been validated as an NS/NA message so that this and any future
ND message handling operate on a linear buffer. The first patch is a small
preparatory cleanup that drops the now-unnecessary skb_header_pointer()
fallback from br_is_nd_neigh_msg().

No functional change is intended for well-formed packets.

Patchset overview:
Patch #1: drop the skb_header_pointer() fallback.
Patches #2-#3: add ndisc_check_ns_na() and validate NS/NA with it.
Patch #4: linearize once the ND message type is validated.
Patch #5: parse options via ndisc_parse_options().

Danielle Ratson (5):
  bridge: Use direct pointer in br_is_nd_neigh_msg()
  ipv6: ndisc: Add ndisc_check_ns_na() validation helper
  bridge: Validate NS/NA messages using ndisc_check_ns_na()
  bridge: Linearize skb once the ND message type is validated
  bridge: Use ndisc_parse_options() to parse ND options in br_nd_send()

 include/net/ndisc.h          |   2 +
 net/bridge/br_arp_nd_proxy.c |  54 +++++-----
 net/bridge/br_device.c       |   4 +-
 net/bridge/br_input.c        |   4 +-
 net/bridge/br_private.h      |   2 +-
 net/ipv6/Makefile            |   2 +-
 net/ipv6/ndisc.c             |   1 +
 net/ipv6/ndisc_snoop.c       | 190 +++++++++++++++++++++++++++++++++++
 8 files changed, 224 insertions(+), 35 deletions(-)
 create mode 100644 net/ipv6/ndisc_snoop.c

-- 
2.54.0