Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ICMPv6: Recognise ND option 14 (Nonce) #1108

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

bonktree
Copy link

@bonktree bonktree commented Dec 4, 2023

This option has been observed to be included in neighbour solicitations sent by Linux kernel when conf/*/enhanced_dad is enabled on the relevant network interface. It looks like it appeared in the linked kernel commit.

In accordance with RFC 7527, a nonce can help distinguish valid DAD NS messages in the presence of Ethernet loopbacks: after a DAD probe is sent on the network, if an NS is received with the same nonce it is considered looped back and ignored.

We implement the printer for this option and add a simple test with 3 different verbosity levels.

@bonktree bonktree marked this pull request as ready for review December 5, 2023 01:16
@infrastation
Copy link
Member

Thank you for waiting. I have only a cosmetic remark, in that

nonce option (14), length 8 (1): 6069604c0aaa

should be formatted as

nonce option (14), length 8 (1): 60:69:60:4c:0a:aa

to minimize confusion when the value is something such as 112233445566. There is a number of occurrences in the existing code that do exactly that, perhaps it is time to deduplicate that code and to make it a function you could use instead of implementing your own.

@vt-alt
Copy link

vt-alt commented Feb 11, 2024

Perhaps 60:69:60:4c:0a:aa could be confused with a mac address, but this is just a nonce number which does not need to be extremely readable.

@bonktree
Copy link
Author

I have only a cosmetic remark, in that

nonce option (14), length 8 (1): 6069604c0aaa

should be formatted as

nonce option (14), length 8 (1): 60:69:60:4c:0a:aa

to minimize confusion when the value is something such as 112233445566. There is a number of occurrences in the existing code that do exactly that, perhaps it is time to deduplicate that code and to make it a function you could use instead of implementing your own.

I like this notation with colons and did consider it for a while, but, as @vt-alt has noted above, the nonce is extremely likely to resemble an Ethernet hardware address, since in practice it will almost definitely be 6 bytes in length (the smallest length possible). So there is a slight chance an inexperienced reader examining the dump might wonder if there is a device with that address.

I'd looked for other established formats for variable-length nonces, and the only other suitable example was in the IKE printer, e. g. in tests/ikev2fourv.out. Other supported protocols use a fixed-size nonce, e. g. a single octet or a 32-bit word, like mptcp and babel; those are printed like 0xaabbccdd.

@bonktree
Copy link
Author

bonktree commented Feb 11, 2024

There might be other options, though; like this:

nonce option (14), length 8 (1): [60:69:60:4c:0a:aa]

or this:

nonce option (14), length 8 (1): nonce(60:69:60:4c:0a:aa)

@infrastation
Copy link
Member

Either that, or the value could use the proper 0x prefix. Bare hex digits is a classic space for misinterpretation.

@vt-alt
Copy link

vt-alt commented Feb 12, 2024

I vote for 0x6069604c0aaa 😄

@fxlb
Copy link
Member

fxlb commented Feb 12, 2024

My doubt about 0x6069604c0aaa was unfounded.

@bonktree
Copy link
Author

or the value could use the proper 0x prefix.

Yes. I'm in favor of 0x6069604c0aaa.

OK, so be it.

This option has been observed to be included in neighbour solicitations
sent by Linux kernel when `conf/*/enhanced_dad` is enabled on the
relevant network interface. It looks like it appeared in the linked
kernel commit.

In accordance with RFC 7527, a nonce can help distinguish valid DAD NS
messages in the presence of Ethernet loopbacks: after a DAD probe is
sent on the network, if an NS is received with the same nonce it is
considered looped back and ignored.

We implement the printer for this option and add a simple test with 3
different verbosity levels.

Link: torvalds/linux@adc176c
Link: https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml#icmpv6-parameters-5
@bonktree
Copy link
Author

bonktree commented Mar 2, 2024

Rebased on latest master with no further changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

4 participants