From 9dfa6cca8959dd203dc9de012126cf80bc4a680e Mon Sep 17 00:00:00 2001 From: Danielle Ratson Date: Mon, 3 Aug 2026 14:25:02 +0300 Subject: ipv6: ndisc: Add ndisc_check_ns_na() validation helper Add ndisc_check_ns_na(), a standalone NS/NA packet validator modeled after ipv6_mc_check_mld(). It performs the RFC 4861 section 7.1.1 (Neighbor Solicitation) and 7.1.2 (Neighbor Advertisement) mandatory checks that are relevant for software operating at the bridge level, where packets bypass the normal IPv6 stack path: - Hop Limit must be 255 (packet was not forwarded by a router) - ICMPv6 checksum is valid - ICMP Code is 0 - ICMP length is at least 24 octets (sizeof(struct nd_msg)) - Target Address must not be a multicast address - All included options have a length that is greater than zero - NS/DAD: destination must be a solicited-node multicast address - NS/DAD: no Source Link-Layer Address option when source is unspecified - NA: Solicited flag must be 0 when IP Destination is multicast On success the function sets the skb transport header and returns 0, matching the convention of ipv6_mc_check_mld(). Reviewed-by: Petr Machata Acked-by: Nikolay Aleksandrov Signed-off-by: Danielle Ratson Link: https://patch.msgid.link/20260803112505.613873-3-danieller@nvidia.com Signed-off-by: Jakub Kicinski --- include/net/ndisc.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include/net') diff --git a/include/net/ndisc.h b/include/net/ndisc.h index 3da1a6f8d3f9..9e5379ad2d8e 100644 --- a/include/net/ndisc.h +++ b/include/net/ndisc.h @@ -430,6 +430,8 @@ void ndisc_update(const struct net_device *dev, struct neighbour *neigh, const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type, struct ndisc_options *ndopts); +int ndisc_check_ns_na(struct sk_buff *skb); + /* * IGMP */ -- cgit v1.2.3