NetBSD Problem Report #60490

From www@netbsd.org  Thu Jul 23 20:40:20 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id D94D31A923B
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 23 Jul 2026 20:40:19 +0000 (UTC)
Message-Id: <20260723204019.095641A923C@mollari.NetBSD.org>
Date: Thu, 23 Jul 2026 20:40:19 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: netinet: ICMP_REDIRECT routes are unbounded
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60490
>Category:       kern
>Synopsis:       netinet: ICMP_REDIRECT routes are unbounded
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 23 20:45:01 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
The NetBSD Redirection, Icmp.
>Environment:
>Description:

	Back a decade or two ago, we added a bound on the number of
	dynamic routes that could be created with ICMP6_REDIRECT
	messages, based on similar changes in OpenBSD from KAME:

--- a/sys/netinet6/icmp6.c
+++ b/sys/netinet6/icmp6.c
@@ -2279,6 +2279,8 @@ icmp6_redirect_input(struct mbuf *m, int off)
 		 * (there will be additional hops, though).
 		 */
 		rtcount = rt_timer_count(icmp6_redirect_timeout_q);
+		if (0 <= ip6_maxdynroutes && rtcount >= ip6_maxdynroutes)
+			goto freeit;
 		if (0 <= icmp6_redirect_hiwat && rtcount > icmp6_redirect_hiwat)
 			return;
 		else if (0 <= icmp6_redirect_lowat &&

	(We also left older experimental icmp6_redirect_hiwat and
	icmp6_redirect_lowat variables around, even though nothing uses
	them; we should just delete those.)

	But we didn't do the same for IPv4 ICMP.  Perhaps we should, in
	order to avoid unbounded growth of the routing table.

	Forwarded to us by Chris Jarrett-Davies <chrisjd@openai.com>.

>How-To-Repeat:

	send a lot of ICMP_REDIRECT messages that pass various other
	kinds of validation

>Fix:

	new ip_maxdynroutes sysctl knob

Home	PR Database Search