From nobody Sat Apr 18 12:41:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38B48C43334 for ; Wed, 13 Jul 2022 22:37:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237328AbiGMWhX (ORCPT ); Wed, 13 Jul 2022 18:37:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38850 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237169AbiGMWhS (ORCPT ); Wed, 13 Jul 2022 18:37:18 -0400 Received: from mail-pj1-x102d.google.com (mail-pj1-x102d.google.com [IPv6:2607:f8b0:4864:20::102d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 233DD12D37; Wed, 13 Jul 2022 15:37:17 -0700 (PDT) Received: by mail-pj1-x102d.google.com with SMTP id g16-20020a17090a7d1000b001ea9f820449so6080527pjl.5; Wed, 13 Jul 2022 15:37:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=wCM0UDHUVihBgY7YWogvcLCrLbNF9p6xLuztOGFMvkI=; b=eV5m75sqAFnxepzIK8VLkfPhxD4p+KPRRpfvA2DYLoWAS+ZPSNM7gcKMdEkJcrV7n+ iSWv7AOzPFr6txsjFrpftnxXpn+qeOQunSe/oqynkZNOKga7Jd2pj4J2YPr65SMzD2ol tJhROGIjKyuCjp3LQATq1AgTXj9N4jhzvcBeANAAo6D9OxO+hlT0gok+r/vrRGv9BgYj zvzH882xXa0D0J9OWr2O8P2WJ3kqPpifI/b3fjTG5Tg/2MH7Nma6C65B9yILrkfJzfmV V6AKcPZGYcFZ4ciejkFAY9RmoCUbT6ET34hbI28ENHt7YIa+EoI4mcn08klYl0bEOK1Y IvdA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=wCM0UDHUVihBgY7YWogvcLCrLbNF9p6xLuztOGFMvkI=; b=Mrm8+bkpr5J30dPZom2bHYZElk1wN9PMsQ/OJgmcA18F41fvffT5tUpFxgcADnpg7X UDzJ7W2qCmRDO6SvQXhr8oU+HXTZWLuiV3PEH3d66qLavRpyxLHLq5byArIIZzmPTWXA ybSdbS/iK37VjQJy1vSfVmZGOckirVoxjbceNnIt2cafCDZ8Veqp7j7774IRy4/Zwqaw Dozjgj7oOLu0M/+OBz/T0JoXSuhiLVHSzIDlQ8nO1zRK5+mA9qVULCJxfIjx7WTxqOQ9 y5hvhZhByODBNsX9e7in0SkhiasZFF/nS16c7+1u/92RKspnGZ+6GQmLYuFpsxRgJR0B Vtmw== X-Gm-Message-State: AJIora+9BNdsQljh0KsA3+pNxYrcYnD8Icmo18ZLw/DTLKj+Vez84htc 9szz4vAfuCJ2tv9aM6z7lz/KJKF/1NfZXyxRhb4= X-Google-Smtp-Source: AGRyM1tOa8OeT+pA1jmPBaIK1AweL/xm29HNIZcuZIjrCD7/FkUl9EiZKX62m/uN6TT6yOHbWghpsA== X-Received: by 2002:a17:902:a413:b0:156:15b:524a with SMTP id p19-20020a170902a41300b00156015b524amr5369620plq.106.1657751836372; Wed, 13 Jul 2022 15:37:16 -0700 (PDT) Received: from localhost.localdomain ([64.141.80.140]) by smtp.gmail.com with ESMTPSA id b18-20020aa78ed2000000b00525302fe9c4sm38639pfr.190.2022.07.13.15.37.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 13 Jul 2022 15:37:15 -0700 (PDT) From: Jaehee Park To: netdev@vger.kernel.org Cc: davem@davemloft.net, yoshfuji@linux-ipv6.org, dsahern@kernel.org, dsahern@gmail.com, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, shuah@kernel.org, linux-kernel@vger.kernel.org, aajith@arista.com, roopa@nvidia.com, roopa.prabhu@gmail.com, aroulin@nvidia.com, sbrivio@redhat.com, jhpark1013@gmail.com Subject: [PATCH v2 net-next 1/3] net: ipv4: new arp_accept option to accept garp only if in-network Date: Wed, 13 Jul 2022 15:37:17 -0700 Message-Id: <93cfe14597ec1205f61366b9902876287465f1cd.1657750543.git.jhpark1013@gmail.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" In many deployments, we want the option to not learn a neighbor from garp if the src ip is not in the same subnet as an address configured on the interface that received the garp message. net.ipv4.arp_accept sysctl is currently used to control creation of a neigh from a received garp packet. This patch adds a new option '2' to net.ipv4.arp_accept which extends option '1' by including the subnet check. Signed-off-by: Jaehee Park Suggested-by: Roopa Prabhu --- Documentation/networking/ip-sysctl.rst | 9 ++++++--- include/linux/inetdevice.h | 2 +- net/ipv4/arp.c | 24 ++++++++++++++++++++++-- 3 files changed, 29 insertions(+), 6 deletions(-) diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/network= ing/ip-sysctl.rst index 4c8bbf5acfd1..5c017fc1e24d 100644 --- a/Documentation/networking/ip-sysctl.rst +++ b/Documentation/networking/ip-sysctl.rst @@ -1633,12 +1633,15 @@ arp_notify - BOOLEAN or hardware address changes. =3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =20 -arp_accept - BOOLEAN - Define behavior for gratuitous ARP frames who's IP is not - already present in the ARP table: +arp_accept - INTEGER + Define behavior for accepting gratuitous ARP (garp) frames from devices + that are not already present in the ARP table: =20 - 0 - don't create new entries in the ARP table - 1 - create new entries in the ARP table + - 2 - create new entries only if the source IP address is in the same + subnet as an address configured on the interface that received the + garp message. =20 Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on. diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h index ead323243e7b..ddb27fc0ee8c 100644 --- a/include/linux/inetdevice.h +++ b/include/linux/inetdevice.h @@ -131,7 +131,7 @@ static inline void ipv4_devconf_setall(struct in_device= *in_dev) IN_DEV_ORCONF((in_dev), IGNORE_ROUTES_WITH_LINKDOWN) =20 #define IN_DEV_ARPFILTER(in_dev) IN_DEV_ORCONF((in_dev), ARPFILTER) -#define IN_DEV_ARP_ACCEPT(in_dev) IN_DEV_ORCONF((in_dev), ARP_ACCEPT) +#define IN_DEV_ARP_ACCEPT(in_dev) IN_DEV_MAXCONF((in_dev), ARP_ACCEPT) #define IN_DEV_ARP_ANNOUNCE(in_dev) IN_DEV_MAXCONF((in_dev), ARP_ANNOUNCE) #define IN_DEV_ARP_IGNORE(in_dev) IN_DEV_MAXCONF((in_dev), ARP_IGNORE) #define IN_DEV_ARP_NOTIFY(in_dev) IN_DEV_MAXCONF((in_dev), ARP_NOTIFY) diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c index af2f12ffc9ca..87c7e3fc5197 100644 --- a/net/ipv4/arp.c +++ b/net/ipv4/arp.c @@ -429,6 +429,26 @@ static int arp_ignore(struct in_device *in_dev, __be32= sip, __be32 tip) return !inet_confirm_addr(net, in_dev, sip, tip, scope); } =20 +static int arp_accept(struct in_device *in_dev, __be32 sip) +{ + struct net *net =3D dev_net(in_dev->dev); + int scope =3D RT_SCOPE_LINK; + + switch (IN_DEV_ARP_ACCEPT(in_dev)) { + case 0: /* Don't create new entries from garp */ + return 0; + case 1: /* Create new entries from garp */ + return 1; + case 2: /* Create a neighbor in the arp table only if sip + * is in the same subnet as an address configured + * on the interface that received the garp message + */ + return !!inet_confirm_addr(net, in_dev, sip, 0, scope); + default: + return 0; + } +} + static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev) { struct rtable *rt; @@ -868,12 +888,12 @@ static int arp_process(struct net *net, struct sock *= sk, struct sk_buff *skb) n =3D __neigh_lookup(&arp_tbl, &sip, dev, 0); =20 addr_type =3D -1; - if (n || IN_DEV_ARP_ACCEPT(in_dev)) { + if (n || arp_accept(in_dev, sip)) { is_garp =3D arp_is_garp(net, dev, &addr_type, arp->ar_op, sip, tip, sha, tha); } =20 - if (IN_DEV_ARP_ACCEPT(in_dev)) { + if (arp_accept(in_dev, sip)) { /* Unsolicited ARP is not accepted by default. It is possible, that this option should be enabled for some devices (strip is candidate) --=20 2.30.2 From nobody Sat Apr 18 12:41:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8068CCA47C for ; Wed, 13 Jul 2022 22:37:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237394AbiGMWh1 (ORCPT ); Wed, 13 Jul 2022 18:37:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38876 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231344AbiGMWhS (ORCPT ); Wed, 13 Jul 2022 18:37:18 -0400 Received: from mail-pj1-x1033.google.com (mail-pj1-x1033.google.com [IPv6:2607:f8b0:4864:20::1033]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 001FC1A05E; Wed, 13 Jul 2022 15:37:17 -0700 (PDT) Received: by mail-pj1-x1033.google.com with SMTP id 89-20020a17090a09e200b001ef7638e536so6087794pjo.3; Wed, 13 Jul 2022 15:37:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=rvr6j7UaN5VGV3LHJmM0Oblok56ZT0nZGaQ8H5yP6gw=; b=Rm0206f99+w1M+mGu0u9cVXiL+6v3ihAKTO2hLWewJEPTV05yzvBRDM4MivAZybcqm d0GIOQRRZXtTVS0ULdgPWxBb+dnQAAZd+OHGK59wARzRG2fZ011+luiJvx66qbRaMhep 5Jia1ApeP0wStf+PSrkMXy/8sk4I5zkoVb9ByICN7Y3yq8KADngctr7pqszuV1kflDtE i/zaDNJKOguLxTXnU61UxcCjqhMlj/yx3d4OzWAFSyUxi88p0l+iUFlsGaBRHlgVCzo1 rwrWMopHSBXoN0qx2J5WAzm06d1wgHW9V5UrRtJ79JziDDp4EJBa/2tF7hGr3f5RirL2 nbpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=rvr6j7UaN5VGV3LHJmM0Oblok56ZT0nZGaQ8H5yP6gw=; b=mQ0QCaTs+SY7yPyR78kE3In8vS3ex3T3hj34F5PvSE+g+uI0IdoOEQiVy375oVlS3K s8Behszs653gkvcX6SVxaTO8rcdqms1SrifXcryokf9EmNWSij+rqrI8ktrbgaHYfTPq 4tj5+sTY0ebeVsPZIrQvuCsV/s8jbtk9fxCtrEqGknB0Qav+PUdKSemwyOHS9Me6tL4u yP/QxOaQNHghsNQDNxnZDiVl6INBAt0a51cvNIIAJPATKsLgMVdPbiSR0isSMvFUcYc/ N6RMhbchBGbIL0EgS+1jASo/8bhP8NTVL28c9ukAsDWgCiU31KvmDlJHEyVUjLzi5HBb P/Mg== X-Gm-Message-State: AJIora9xVsoZ5Jmc8cNOw4C8w8Hk8QMCuhm4ekpBP6/SwOzg7kPrsH/y movvcH1IssS0GiamLsxefJSPD2SHvMotVahK2Uw= X-Google-Smtp-Source: AGRyM1tarPjS2nwCeO8onebtNzgGuyQHvSxyhTgZwZ9ueFo+KkFH8uh2miT/JhMGMzdfnyY1qxMe6w== X-Received: by 2002:a17:903:2d1:b0:168:e83e:dab0 with SMTP id s17-20020a17090302d100b00168e83edab0mr5209716plk.118.1657751837389; Wed, 13 Jul 2022 15:37:17 -0700 (PDT) Received: from localhost.localdomain ([64.141.80.140]) by smtp.gmail.com with ESMTPSA id b18-20020aa78ed2000000b00525302fe9c4sm38639pfr.190.2022.07.13.15.37.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 13 Jul 2022 15:37:16 -0700 (PDT) From: Jaehee Park To: netdev@vger.kernel.org Cc: davem@davemloft.net, yoshfuji@linux-ipv6.org, dsahern@kernel.org, dsahern@gmail.com, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, shuah@kernel.org, linux-kernel@vger.kernel.org, aajith@arista.com, roopa@nvidia.com, roopa.prabhu@gmail.com, aroulin@nvidia.com, sbrivio@redhat.com, jhpark1013@gmail.com Subject: [PATCH v2 net-next 2/3] net: ipv6: new accept_untracked_na option to accept na only if in-network Date: Wed, 13 Jul 2022 15:37:18 -0700 Message-Id: <56d57be31141c12e9034cfa7570f2012528ca884.1657750543.git.jhpark1013@gmail.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" This patch adds a third knob, '2', which extends the accept_untracked_na option to learn a neighbor only if the src ip is in the same subnet as an address configured on the interface that received the neighbor advertisement. This is similar to the arp_accept configuration for ipv4. Signed-off-by: Jaehee Park Suggested-by: Roopa Prabhu --- Documentation/networking/ip-sysctl.rst | 51 +++++++++++++++----------- net/ipv6/addrconf.c | 2 +- net/ipv6/ndisc.c | 29 ++++++++++++--- 3 files changed, 55 insertions(+), 27 deletions(-) diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/network= ing/ip-sysctl.rst index 5c017fc1e24d..722ec4f491db 100644 --- a/Documentation/networking/ip-sysctl.rst +++ b/Documentation/networking/ip-sysctl.rst @@ -2483,27 +2483,36 @@ drop_unsolicited_na - BOOLEAN =20 By default this is turned off. =20 -accept_untracked_na - BOOLEAN - Add a new neighbour cache entry in STALE state for routers on receiving a - neighbour advertisement (either solicited or unsolicited) with target - link-layer address option specified if no neighbour entry is already - present for the advertised IPv6 address. Without this knob, NAs received - for untracked addresses (absent in neighbour cache) are silently ignored. - - This is as per router-side behaviour documented in RFC9131. - - This has lower precedence than drop_unsolicited_na. - - This will optimize the return path for the initial off-link communication - that is initiated by a directly connected host, by ensuring that - the first-hop router which turns on this setting doesn't have to - buffer the initial return packets to do neighbour-solicitation. - The prerequisite is that the host is configured to send - unsolicited neighbour advertisements on interface bringup. - This setting should be used in conjunction with the ndisc_notify setting - on the host to satisfy this prerequisite. - - By default this is turned off. +accept_untracked_na - INTEGER + Define behavior for accepting neighbor advertisements from devices that + are absent in the neighbor cache: + + - 0 - (default) Do not accept unsolicited and untracked neighbor + advertisements. + + - 1 - Add a new neighbor cache entry in STALE state for routers on + receiving a neighbor advertisement (either solicited or unsolicited) + with target link-layer address option specified if no neighbor entry + is already present for the advertised IPv6 address. Without this knob, + NAs received for untracked addresses (absent in neighbor cache) are + silently ignored. + + This is as per router-side behavior documented in RFC9131. + + This has lower precedence than drop_unsolicited_na. + + This will optimize the return path for the initial off-link + communication that is initiated by a directly connected host, by + ensuring that the first-hop router which turns on this setting doesn't + have to buffer the initial return packets to do neighbor-solicitation. + The prerequisite is that the host is configured to send unsolicited + neighbor advertisements on interface bringup. This setting should be + used in conjunction with the ndisc_notify setting on the host to + satisfy this prerequisite. + + - 2 - Extend option (1) to add a new neighbor cache entry only if the + source IP address is in the same subnet as an address configured on + the interface that received the neighbor advertisement. =20 enhanced_dad - BOOLEAN Include a nonce option in the IPv6 neighbor solicitation messages used for diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 88becb037eb6..6ed807b6c647 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -7042,7 +7042,7 @@ static const struct ctl_table addrconf_sysctl[] =3D { .data =3D &ipv6_devconf.accept_untracked_na, .maxlen =3D sizeof(int), .mode =3D 0644, - .proc_handler =3D proc_dointvec_minmax, + .proc_handler =3D proc_dointvec, .extra1 =3D (void *)SYSCTL_ZERO, .extra2 =3D (void *)SYSCTL_ONE, }, diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index cd84cbdac0a2..98453693e400 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c @@ -967,6 +967,25 @@ static void ndisc_recv_ns(struct sk_buff *skb) in6_dev_put(idev); } =20 +static int accept_untracked_na(struct net_device *dev, struct in6_addr *sa= ddr) +{ + struct inet6_dev *idev =3D __in6_dev_get(dev); + + switch (idev->cnf.accept_untracked_na) { + case 0: /* Don't accept untracked na (absent in neighbor cache) */ + return 0; + case 1: /* Create new entries from na if currently untracked */ + return 1; + case 2: /* Create new entries from untracked na only if saddr is in the + * same subnet as an address configured on the interface that + * received the na + */ + return !!ipv6_chk_prefix(saddr, dev); + default: + return 0; + } +} + static void ndisc_recv_na(struct sk_buff *skb) { struct nd_msg *msg =3D (struct nd_msg *)skb_transport_header(skb); @@ -1061,11 +1080,11 @@ static void ndisc_recv_na(struct sk_buff *skb) * Note that we don't do a (daddr =3D=3D all-routers-mcast) check. */ new_state =3D msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE; - if (!neigh && lladdr && - idev && idev->cnf.forwarding && - idev->cnf.accept_untracked_na) { - neigh =3D neigh_create(&nd_tbl, &msg->target, dev); - new_state =3D NUD_STALE; + if (!neigh && lladdr && idev && idev->cnf.forwarding) { + if (accept_untracked_na(dev, saddr)) { + neigh =3D neigh_create(&nd_tbl, &msg->target, dev); + new_state =3D NUD_STALE; + } } =20 if (neigh && !IS_ERR(neigh)) { --=20 2.30.2 From nobody Sat Apr 18 12:41:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8A1EDC433EF for ; Wed, 13 Jul 2022 22:37:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237418AbiGMWh3 (ORCPT ); Wed, 13 Jul 2022 18:37:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38958 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237286AbiGMWhU (ORCPT ); Wed, 13 Jul 2022 18:37:20 -0400 Received: from mail-pf1-x42c.google.com (mail-pf1-x42c.google.com [IPv6:2607:f8b0:4864:20::42c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 530204E63D; Wed, 13 Jul 2022 15:37:19 -0700 (PDT) Received: by mail-pf1-x42c.google.com with SMTP id e16so227771pfm.11; Wed, 13 Jul 2022 15:37:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=pgW48c0N3USrHUfuf5UKYDEqj95oiLKlw+S6Gbe3A/o=; b=i/UEY7GxE1lTBrwui/k/YKEtKcDS6fMnzJMXMtIfY9La6ZCSV/ULuKg443N7/6y9lJ qTGe47TwPj/SpFOoRKpGUQ+bBZwhbv0297f9LuhBwj+CcWHGyBCDu3j7XXcnL14tHgug L7IwQFMuB2ORr2pJQBLjbB0Jl/6USldznKN66NOgqFNMHqZ86cXnMDPGvoHIw0YdvyQj 0PM9qOsjP14KqLwsgmeymEmRmoGR2SiU4XPIITspjHNNJF7bCeCodlvFwsypoQlBqQXN 58U8H7dHinuFd1VM9u3POeWllqsMhJHMkKlNwHd4vV/wfnvDBF+E1C/tGbjEyLfeACV0 Swtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=pgW48c0N3USrHUfuf5UKYDEqj95oiLKlw+S6Gbe3A/o=; b=7hSZt2TQvzLKyB6ama7ly9XDBhG1RTjsM1x9lPuPV0dpd3N7DsLj9tQNFjr/QEu9d6 z3RX5lR0h9fiLpQ5T47rBlCpcz8+R+QAUH5SVTM3eFfaCKWqpj9aw/Zk3Dpjio++ijYI waQBx3WAU4j+LQcclr4wK6/fetJoG9pmX2rId5SuUe2rndzA5bLp1ng9hS2zGFcXbqzU rK3QEDNTlWNFsu9uNHUleazWkj7g3bIIQ5GKMAKeHzUXQM6Qr3xd3fhc77P6o5HiruyJ cS3Kj7321kL2BxfcxJh0a/GIJnWLmFh9EUDh5pn0Nu3VUjzhvuAIi8AclCtDmntnH59Q wmVg== X-Gm-Message-State: AJIora+NBpV3uYfQlEn3I6LnB1/Ls6U7sMq7gz+suEVrfHIUsxGU5vLW OIZtYFpm/kN29Pwd7dYWiF0mQPmYuWLWuVr5ZZg= X-Google-Smtp-Source: AGRyM1vKtwcvzPzVHsiC3Ie5zRWDNJ2kbqBNbqpJPIyjw+p5W192eQzMc2+BIQ5qnGkXaxMwNtw03A== X-Received: by 2002:a65:6907:0:b0:415:c9c1:eb4f with SMTP id s7-20020a656907000000b00415c9c1eb4fmr4779211pgq.193.1657751838461; Wed, 13 Jul 2022 15:37:18 -0700 (PDT) Received: from localhost.localdomain ([64.141.80.140]) by smtp.gmail.com with ESMTPSA id b18-20020aa78ed2000000b00525302fe9c4sm38639pfr.190.2022.07.13.15.37.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 13 Jul 2022 15:37:18 -0700 (PDT) From: Jaehee Park To: netdev@vger.kernel.org Cc: davem@davemloft.net, yoshfuji@linux-ipv6.org, dsahern@kernel.org, dsahern@gmail.com, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, shuah@kernel.org, linux-kernel@vger.kernel.org, aajith@arista.com, roopa@nvidia.com, roopa.prabhu@gmail.com, aroulin@nvidia.com, sbrivio@redhat.com, jhpark1013@gmail.com Subject: [PATCH v2 net-next 3/3] selftests: net: arp_ndisc_untracked_subnets: test for arp_accept and accept_untracked_na Date: Wed, 13 Jul 2022 15:37:19 -0700 Message-Id: <4f9916058458b8d802ce47f5d19aba213e50b6bc.1657750543.git.jhpark1013@gmail.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" ipv4 arp_accept has a new option '2' to create new neighbor entries only if the src ip is in the same subnet as an address configured on the interface that received the garp message. This selftest tests all options in arp_accept. ipv6 has a sysctl endpoint, accept_untracked_na, that defines the behavior for accepting untracked neighbor advertisements. A new option similar to that of arp_accept for learning only from the same subnet is added to accept_untracked_na. This selftest tests this new feature. Signed-off-by: Jaehee Park Suggested-by: Roopa Prabhu --- tools/testing/selftests/net/Makefile | 1 + .../net/arp_ndisc_untracked_subnets.sh | 308 ++++++++++++++++++ 2 files changed, 309 insertions(+) create mode 100755 tools/testing/selftests/net/arp_ndisc_untracked_subnets= .sh diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests= /net/Makefile index ddad703ace34..9c2e9e303c37 100644 --- a/tools/testing/selftests/net/Makefile +++ b/tools/testing/selftests/net/Makefile @@ -38,6 +38,7 @@ TEST_PROGS +=3D srv6_end_dt6_l3vpn_test.sh TEST_PROGS +=3D vrf_strict_mode_test.sh TEST_PROGS +=3D arp_ndisc_evict_nocarrier.sh TEST_PROGS +=3D ndisc_unsolicited_na_test.sh +TEST_PROGS +=3D arp_ndisc_untracked_subnets.sh TEST_PROGS +=3D stress_reuseport_listen.sh TEST_PROGS_EXTENDED :=3D in_netns.sh setup_loopback.sh setup_veth.sh TEST_PROGS_EXTENDED +=3D toeplitz_client.sh toeplitz.sh diff --git a/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh b/t= ools/testing/selftests/net/arp_ndisc_untracked_subnets.sh new file mode 100755 index 000000000000..689ecfacee10 --- /dev/null +++ b/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh @@ -0,0 +1,308 @@ +#!/bin/bash +# SPDX-License-Identifier: GPL-2.0 +# +# 2 namespaces: one host and one router. Use arping from the host to send a +# garp to the router. Router accepts or ignores based on its arp_accept +# or accept_untracked_na configuration. + +TESTS=3D"arp ndisc" + +ROUTER_NS=3D"ns-router" +ROUTER_NS_V6=3D"ns-router-v6" +ROUTER_INTF=3D"veth-router" +ROUTER_ADDR=3D"10.0.10.1" +ROUTER_ADDR_V6=3D"2001:db8:abcd:0012::1" + +HOST_NS=3D"ns-host" +HOST_NS_V6=3D"ns-host-v6" +HOST_INTF=3D"veth-host" +HOST_ADDR=3D"10.0.10.2" +HOST_ADDR_V6=3D"2001:db8:abcd:0012::2" + +SUBNET_WIDTH=3D24 +PREFIX_WIDTH_V6=3D64 + +cleanup() { + ip netns del ${HOST_NS} + ip netns del ${ROUTER_NS} +} + +cleanup_v6() { + ip netns del ${HOST_NS_V6} + ip netns del ${ROUTER_NS_V6} +} + +setup() { + set -e + local arp_accept=3D$1 + + # Set up two namespaces + ip netns add ${ROUTER_NS} + ip netns add ${HOST_NS} + + # Set up interfaces veth0 and veth1, which are pairs in separate + # namespaces. veth0 is veth-router, veth1 is veth-host. + # first, set up the inteface's link to the namespace + # then, set the interface "up" + ip netns exec ${ROUTER_NS} ip link add name ${ROUTER_INTF} \ + type veth peer name ${HOST_INTF} + + ip netns exec ${ROUTER_NS} ip link set dev ${ROUTER_INTF} up + ip netns exec ${ROUTER_NS} ip link set dev ${HOST_INTF} netns ${HO= ST_NS} + + ip netns exec ${HOST_NS} ip link set dev ${HOST_INTF} up + ip netns exec ${ROUTER_NS} ip addr add ${ROUTER_ADDR}/${SUBNET_WID= TH} \ + dev ${ROUTER_INTF} + + ip netns exec ${HOST_NS} ip addr add ${HOST_ADDR}/${SUBNET_WIDTH} \ + dev ${HOST_INTF} + ip netns exec ${HOST_NS} ip route add default via ${HOST_ADDR} \ + dev ${HOST_INTF} + ip netns exec ${ROUTER_NS} ip route add default via ${ROUTER_ADDR}= \ + dev ${ROUTER_INTF} + + ROUTER_CONF=3Dnet.ipv4.conf.${ROUTER_INTF} + ip netns exec ${ROUTER_NS} sysctl -w \ + ${ROUTER_CONF}.arp_accept=3D${arp_accept} >/dev/null 2>&1 + set +e +} + +setup_v6() { + set -e + local accept_untracked_na=3D$1 + + # Set up two namespaces + ip netns add ${ROUTER_NS_V6} + ip netns add ${HOST_NS_V6} + + # Set up interfaces veth0 and veth1, which are pairs in separate + # namespaces. veth0 is veth-router, veth1 is veth-host. + # first, set up the inteface's link to the namespace + # then, set the interface "up" + ip -6 -netns ${ROUTER_NS_V6} link add name ${ROUTER_INTF} \ + type veth peer name ${HOST_INTF} + + ip -6 -netns ${ROUTER_NS_V6} link set dev ${ROUTER_INTF} up + ip -6 -netns ${ROUTER_NS_V6} link set dev ${HOST_INTF} netns \ + ${HOST_NS_V6} + + ip -6 -netns ${HOST_NS_V6} link set dev ${HOST_INTF} up + ip -6 -netns ${ROUTER_NS_V6} addr add \ + ${ROUTER_ADDR_V6}/${PREFIX_WIDTH_V6} dev ${ROUTER_INTF} no= dad + + HOST_CONF=3Dnet.ipv6.conf.${HOST_INTF} + ip netns exec ${HOST_NS_V6} sysctl -qw ${HOST_CONF}.ndisc_notify= =3D1 + ip netns exec ${HOST_NS_V6} sysctl -qw ${HOST_CONF}.disable_ipv6= =3D0 + ip -6 -netns ${HOST_NS_V6} addr add ${HOST_ADDR_V6}/${PREFIX_WIDTH= _V6} \ + dev ${HOST_INTF} + + ROUTER_CONF=3Dnet.ipv6.conf.${ROUTER_INTF} + + ip netns exec ${ROUTER_NS_V6} sysctl -w \ + ${ROUTER_CONF}.forwarding=3D1 >/dev/null 2>&1 + ip netns exec ${ROUTER_NS_V6} sysctl -w \ + ${ROUTER_CONF}.drop_unsolicited_na=3D0 >/dev/null 2>&1 + ip netns exec ${ROUTER_NS_V6} sysctl -w \ + ${ROUTER_CONF}.accept_untracked_na=3D${accept_untracked_na= } \ + >/dev/null 2>&1 + set +e +} + +verify_arp() { + local arp_accept=3D$1 + local same_subnet=3D$2 + + neigh_show_output=3D$(ip netns exec ${ROUTER_NS} ip neigh get \ + ${HOST_ADDR} dev ${ROUTER_INTF} 2>/dev/null) + + if [ ${arp_accept} -eq 1 ]; then + # Neighbor entries expected + [[ ${neigh_show_output} ]] + elif [ ${arp_accept} -eq 2 ]; then + if [ ${same_subnet} -eq 1 ]; then + # Neighbor entries expected + [[ ${neigh_show_output} ]] + else + [[ -z "${neigh_show_output}" ]] + fi + else + [[ -z "${neigh_show_output}" ]] + fi + } + +arp_test_gratuitous() { + set -e + local arp_accept=3D$1 + local same_subnet=3D$2 + + if [ ${arp_accept} -eq 2 ]; then + test_msg=3D("test_arp: " + "accept_arp=3D$1 " + "same_subnet=3D$2") + if [ ${same_subnet} -eq 0 ]; then + HOST_ADDR=3D10.0.11.3 + else + HOST_ADDR=3D10.0.10.3 + fi + else + test_msg=3D("test_arp: " + "accept_arp=3D$1") + fi + # Supply arp_accept option to set up which sets it in sysctl + setup ${arp_accept} + ip netns exec ${HOST_NS} arping -A -U ${HOST_ADDR} -c1 2>&1 >/dev/= null + + if verify_arp $1 $2; then + printf " TEST: %-60s [ OK ]\n" "${test_msg[*]}" + else + printf " TEST: %-60s [FAIL]\n" "${test_msg[*]}" + fi + cleanup + set +e +} + +arp_test_gratuitous_combinations() { + arp_test_gratuitous 0 + arp_test_gratuitous 1 + arp_test_gratuitous 2 0 # Second entry indicates subnet or not + arp_test_gratuitous 2 1 +} + +cleanup_tcpdump() { + set -e + [[ ! -z ${tcpdump_stdout} ]] && rm -f ${tcpdump_stdout} + [[ ! -z ${tcpdump_stderr} ]] && rm -f ${tcpdump_stderr} + tcpdump_stdout=3D + tcpdump_stderr=3D + set +e +} + +start_tcpdump() { + set -e + tcpdump_stdout=3D`mktemp` + tcpdump_stderr=3D`mktemp` + ip netns exec ${ROUTER_NS_V6} timeout 15s \ + tcpdump --immediate-mode -tpni ${ROUTER_INTF} -c 1 \ + "icmp6 && icmp6[0] =3D=3D 136 && src ${HOST_ADDR_V6}" \ + > ${tcpdump_stdout} 2> /dev/null + set +e +} + +verify_ndisc() { + local accept_untracked_na=3D$1 + local same_subnet=3D$2 + + neigh_show_output=3D$(ip -6 -netns ${ROUTER_NS_V6} neigh show \ + to ${HOST_ADDR_V6} dev ${ROUTER_INTF} nud stale) + + if [ ${accept_untracked_na} -eq 1 ]; then + # Neighbour entry expected to be present + [[ ${neigh_show_output} ]] + elif [ ${accept_untracked_na} -eq 2 ]; then + if [ ${same_subnet} -eq 1 ]; then + [[ ${neigh_show_output} ]] + else + [[ -z "${neigh_show_output}" ]] + fi + else + # Neighbour entry expected to be absent for all other cases + [[ -z "${neigh_show_output}" ]] + fi +} + +ndisc_test_untracked_advertisements() { + set -e + test_msg=3D("test_ndisc: " + "accept_untracked_na=3D$1") + + local accept_untracked_na=3D$1 + local same_subnet=3D$2 + if [ ${accept_untracked_na} -eq 2 ]; then + test_msg=3D("test_ndisc: " + "accept_untracked_na=3D$1 " + "same_subnet=3D$2") + if [ ${same_subnet} -eq 0 ]; then + # Not same subnet + HOST_ADDR_V6=3D2000:db8:abcd:0013::4 + else + HOST_ADDR_V6=3D2001:db8:abcd:0012::3 + fi + fi + setup_v6 $1 $2 + start_tcpdump + + if verify_ndisc $1 $2; then + printf " TEST: %-60s [ OK ]\n" "${test_msg[*]}" + else + printf " TEST: %-60s [FAIL]\n" "${test_msg[*]}" + fi + + cleanup_tcpdump + cleanup_v6 + set +e +} + +ndisc_test_untracked_combinations() { + ndisc_test_untracked_advertisements 0 + ndisc_test_untracked_advertisements 1 + ndisc_test_untracked_advertisements 2 0 + ndisc_test_untracked_advertisements 2 1 +} + +##########################################################################= ###### +# usage + +usage() +{ + cat < Test(s) to run (default: all) + (options: $TESTS) +EOF +} + +##########################################################################= ###### +# main + +while getopts ":t:h" opt; do + case $opt in + t) TESTS=3D$OPTARG;; + h) usage; exit 0;; + *) usage; exit 1;; + esac +done + +if [ "$(id -u)" -ne 0 ];then + echo "SKIP: Need root privileges" + exit $ksft_skip; +fi + +if [ ! -x "$(command -v ip)" ]; then + echo "SKIP: Could not run test without ip tool" + exit $ksft_skip +fi + +if [ ! -x "$(command -v tcpdump)" ]; then + echo "SKIP: Could not run test without tcpdump tool" + exit $ksft_skip +fi + +if [ ! -x "$(command -v arping)" ]; then + echo "SKIP: Could not run test without arping tool" + exit $ksft_skip +fi + +# start clean +cleanup &> /dev/null +cleanup_v6 &> /dev/null + +for t in $TESTS +do + case $t in + arp_test_gratuitous_combinations|arp) arp_test_gratuitous_combinat= ions;; + ndisc_test_untracked_combinations|ndisc) \ + ndisc_test_untracked_combinations;; + help) echo "Test names: $TESTS"; exit 0;; +esac +done --=20 2.30.2