Commit 30fc7efa authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Jakub Kicinski
Browse files

net, neigh: Reject creating NUD_PERMANENT with NTF_MANAGED entries 



The combination of NUD_PERMANENT + NTF_MANAGED is not supported and does
not make sense either given the former indicates a static/fixed neighbor
entry whereas the latter a dynamically resolved one. While it is possible
to transition from one over to the other, we should however reject such
creation attempts.

Fixes: 7482e384 ("net, neigh: Add NTF_MANAGED flag for managed neighbor entries")
Suggested-by: default avatarDavid Ahern <dsahern@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent c8e80c11

net/core/neighbour.c

+8 −3
Original line number Diff line number Diff line
@@ -1999,15 +1999,20 @@ static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh, 


	neigh = neigh_lookup(tbl, dst, dev);

	if (neigh == NULL) {

		bool exempt_from_gc;

		bool ndm_permanent  = ndm->ndm_state & NUD_PERMANENT;

		bool exempt_from_gc = ndm_permanent ||

				      ndm_flags & NTF_EXT_LEARNED;



		if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {

			err = -ENOENT;

			goto out;

		}

		if (ndm_permanent && (ndm_flags & NTF_MANAGED)) {

			NL_SET_ERR_MSG(extack, "Invalid NTF_* flag for permanent entry");

			err = -EINVAL;

			goto out;

		}



		exempt_from_gc = ndm->ndm_state & NUD_PERMANENT ||

				 ndm_flags & NTF_EXT_LEARNED;

		neigh = ___neigh_create(tbl, dst, dev,

					ndm_flags &

					(NTF_EXT_LEARNED | NTF_MANAGED),