ndp: validate router solicitations

Validate Router Solicitation messages before replying: enforce minimum
ICMP payload length, validate option structure, reject multicast sources
and reject SLLA options when the source is the unspecified address.
Continue to accept solicitations with no options, valid SLLA options, or
unknown (yet complete) options per RFC 4861.

When replying to a valid solicitation, send solicited RAs to all-nodes
multicast for unspecified sources and unicast them back to link-local
sources. Keep receive-loop storm backoff, but only after successfully
received packets so idle timeouts are not delayed.

Signed-off-by: Trey Aspelund <trey@oxidecomputer.com>

Author: taspelund

ndp/src/manager.rs

@@ -146,7 +146,9 @@ fn rx_loop(
                 if let Ok(ra) = Icmp6RouterAdvertisement::from_wire(buf) {
                     handle_ra(&ifx, &state, &log, ra, src);
                 }
-                if let Ok(rs) = Icmp6RouterSolicitation::from_wire(buf) {
+                if let Ok(rs) =
+                    Icmp6RouterSolicitation::from_wire_with_source(buf, src)
+                {
                     handle_rs(&s, &ifx, &state, &log, rs, src);
                 }
             }
@@ -220,16 +222,34 @@ fn handle_rs(
     _rs: Icmp6RouterSolicitation,
     src: Ipv6Addr,
 ) {
+    let Some(dst) = solicited_ra_destination(src) else {
+        debug!(
+            log,
+            "ignoring RS from non-link-local source {src} on {}", ifx.name,
+        );
+        return;
+    };
+
     send_ra(
         sk,
         ifx.ip,
-        Some(src),
+        dst,
         ifx.scope_id,
         state.get_tx_router_lifetime(),
         log,
     );
 }
 
+fn solicited_ra_destination(src: Ipv6Addr) -> Option<Option<Ipv6Addr>> {
+    if src.is_unspecified() {
+        Some(None)
+    } else if src.is_unicast_link_local() {
+        Some(Some(src))
+    } else {
+        None
+    }
+}
+
 /// Check to see if the reachable time for our current peer (if any) is expired.
 /// If so, remove the peer.
 fn check_expired(state: &RouterDiscoveryState) {
@@ -409,6 +429,145 @@ mod test {
         Icmp6RouterAdvertisement::from_wire(&data)
             .expect_err("RS should not parse as RA");
         Icmp6RouterSolicitation::from_wire(&data).expect("parsed solicitation");
+        Icmp6RouterSolicitation::from_wire_with_source(
+            &data,
+            "fe80::1".parse().unwrap(),
+        )
+        .expect("parsed solicitation with link-local source");
+    }
+
+    #[test]
+    fn router_solicitation_from_unspecified_rejects_slla() {
+        let data: [u8; 16] = [
+            133, 0, 11, 22, // type, code checksum
+            0, 0, 0, 0, // reserved
+            1, 1, 0xab, 0xbb, // source link-layer addr option
+            0xcc, 0xdd, 0xee, 0xff,
+        ];
+
+        assert!(matches!(
+            Icmp6RouterSolicitation::from_wire_with_source(
+                &data,
+                Ipv6Addr::UNSPECIFIED,
+            ),
+            Err(crate::packet::Icmp6RsParseError::SllaFromUnspecifiedSource),
+        ));
+    }
+
+    #[test]
+    fn router_solicitation_rejects_multicast_source() {
+        let data: [u8; 8] = [133, 0, 11, 22, 0, 0, 0, 0];
+        let source = "ff02::1".parse().unwrap();
+
+        assert!(matches!(
+            Icmp6RouterSolicitation::from_wire_with_source(&data, source),
+            Err(crate::packet::Icmp6RsParseError::MulticastSource(
+                err_source,
+            )) if err_source == source,
+        ));
+    }
+
+    #[test]
+    fn router_solicitation_rejects_truncated_payload() {
+        let data: [u8; 7] = [133, 0, 11, 22, 0, 0, 0];
+
+        assert!(matches!(
+            Icmp6RouterSolicitation::from_wire(&data),
+            Err(crate::packet::Icmp6RsParseError::TooShort(7)),
+        ));
+    }
+
+    #[test]
+    fn router_solicitation_rejects_truncated_option_header() {
+        let data: [u8; 9] = [
+            133, 0, 11, 22, // type, code, checksum
+            0, 0, 0, 0, // reserved
+            1, // truncated source link-layer address option header
+        ];
+
+        assert!(matches!(
+            Icmp6RouterSolicitation::from_wire(&data),
+            Err(crate::packet::Icmp6RsParseError::Option(
+                crate::packet::Icmp6RsOptionParseError::TruncatedHeader {
+                    remaining: 1,
+                },
+            )),
+        ));
+    }
+
+    #[test]
+    fn router_solicitation_rejects_zero_length_option() {
+        let data: [u8; 16] = [
+            133, 0, 11, 22, // type, code checksum
+            0, 0, 0, 0, // reserved
+            1, 0, 0xab, 0xbb, // zero-length source link-layer addr option
+            0xcc, 0xdd, 0xee, 0xff,
+        ];
+
+        assert!(matches!(
+            Icmp6RouterSolicitation::from_wire(&data),
+            Err(crate::packet::Icmp6RsParseError::Option(
+                crate::packet::Icmp6RsOptionParseError::ZeroLength {
+                    option_type: 1,
+                },
+            )),
+        ));
+    }
+
+    #[test]
+    fn router_solicitation_rejects_truncated_option_body() {
+        let data: [u8; 15] = [
+            133, 0, 11, 22, // type, code checksum
+            0, 0, 0, 0, // reserved
+            1, 1, 0xab, 0xbb, // truncated source link-layer addr option
+            0xcc, 0xdd, 0xee,
+        ];
+
+        assert!(matches!(
+            Icmp6RouterSolicitation::from_wire(&data),
+            Err(crate::packet::Icmp6RsParseError::Option(
+                crate::packet::Icmp6RsOptionParseError::TruncatedOption {
+                    option_type: 1,
+                    option_len: 8,
+                    remaining: 7,
+                },
+            )),
+        ));
+    }
+
+    #[test]
+    fn router_solicitation_rejects_trailing_partial_option() {
+        let data: [u8; 17] = [
+            133, 0, 11, 22, // type, code checksum
+            0, 0, 0, 0, // reserved
+            1, 1, 0xab, 0xbb, // complete source link-layer addr option
+            0xcc, 0xdd, 0xee, 0xff,
+            5, // trailing partial unknown option header
+        ];
+
+        assert!(matches!(
+            Icmp6RouterSolicitation::from_wire(&data),
+            Err(crate::packet::Icmp6RsParseError::Option(
+                crate::packet::Icmp6RsOptionParseError::TruncatedHeader {
+                    remaining: 1,
+                },
+            )),
+        ));
+    }
+
+    #[test]
+    fn router_solicitation_accepts_complete_unknown_option() {
+        let data: [u8; 24] = [
+            133, 0, 11, 22, // type, code checksum
+            0, 0, 0, 0, // reserved
+            1, 1, 0xab, 0xbb, // complete source link-layer addr option
+            0xcc, 0xdd, 0xee, 0xff, 253, 1, 0,
+            0, // complete unknown option
+            0, 0, 0, 0,
+        ];
+
+        Icmp6RouterSolicitation::from_wire(&data)
+            .expect("parsed solicitation with complete unknown option");
     }
 
     #[test]
@@ -431,6 +590,30 @@ mod test {
         Icmp6RouterSolicitation::from_wire(&data).expect("parsed solicitation");
     }
 
+    #[test]
+    fn router_solicitation_from_unspecified_replies_to_all_nodes() {
+        assert_eq!(
+            super::solicited_ra_destination(Ipv6Addr::UNSPECIFIED),
+            Some(None),
+        );
+    }
+
+    #[test]
+    fn router_solicitation_from_link_local_replies_to_sender() {
+        let src = "fe80::1".parse().unwrap();
+
+        assert_eq!(super::solicited_ra_destination(src), Some(Some(src)),);
+    }
+
+    #[test]
+    fn router_solicitation_from_non_link_local_is_ignored() {
+        let global = "2001:db8::1".parse().unwrap();
+        let loopback = Ipv6Addr::LOCALHOST;
+
+        assert_eq!(super::solicited_ra_destination(global), None,);
+        assert_eq!(super::solicited_ra_destination(loopback), None,);
+    }
+
     #[test]
     fn minimum_router_advertisement() {
         // Attempt to parse a minimal ICMPv6 router advertisement as a

ndp/src/packet.rs

@@ -7,6 +7,7 @@
 // Copyright 2026 Oxide Computer Company
 
 use serde::{Deserialize, Serialize};
+use std::net::Ipv6Addr;
 use std::time::Duration;
 
 /// ICMP6 router advertisement
@@ -122,14 +123,46 @@ pub struct Icmp6RouterSolicitation {
 impl Icmp6RouterSolicitation {
     const TYPE: u8 = 133;
     const CODE: u8 = 0;
+    const MIN_PAYLOAD_LEN: usize = 8;
+    // Source Link-Layer Address option.
+    const OPTION_SLLA: u8 = 1;
+
+    #[cfg(test)]
+    pub(crate) fn from_wire(buf: &[u8]) -> Result<Self, Icmp6RsParseError> {
+        Self::from_wire_impl(buf, None)
+    }
+
+    pub fn from_wire_with_source(
+        buf: &[u8],
+        source: Ipv6Addr,
+    ) -> Result<Self, Icmp6RsParseError> {
+        Self::from_wire_impl(buf, Some(source))
+    }
+
+    fn from_wire_impl(
+        buf: &[u8],
+        source: Option<Ipv6Addr>,
+    ) -> Result<Self, Icmp6RsParseError> {
+        // Per RFC 4861 Section 6.1.1: a valid RS has an ICMP payload of >= 8b.
+        if buf.len() < Self::MIN_PAYLOAD_LEN {
+            return Err(Icmp6RsParseError::TooShort(buf.len()));
+        }
 
-    pub fn from_wire(buf: &[u8]) -> Result<Self, Icmp6RsFromWireError> {
         let s: Self = ispf::from_bytes_be(buf)?;
         if s.typ != Self::TYPE {
-            return Err(Icmp6RsFromWireError::WrongType(s.typ));
+            return Err(Icmp6RsParseError::WrongType(s.typ));
         }
         if s.code != Self::CODE {
-            return Err(Icmp6RsFromWireError::WrongCode(s.code));
+            return Err(Icmp6RsParseError::WrongCode(s.code));
+        }
+        let has_slla = validate_nd_options(&buf[Self::MIN_PAYLOAD_LEN..])?;
+        if let Some(source) = source {
+            if source.is_multicast() {
+                return Err(Icmp6RsParseError::MulticastSource(source));
+            }
+            if source.is_unspecified() && has_slla {
+                return Err(Icmp6RsParseError::SllaFromUnspecifiedSource);
+            }
         }
         Ok(s)
     }
@@ -146,14 +179,80 @@ impl Default for Icmp6RouterSolicitation {
     }
 }
 
+fn validate_nd_options(buf: &[u8]) -> Result<bool, Icmp6RsOptionParseError> {
+    let mut offset = 0;
+    let mut has_slla = false;
+    while offset < buf.len() {
+        if buf.len() - offset < 2 {
+            return Err(Icmp6RsOptionParseError::TruncatedHeader {
+                remaining: buf.len() - offset,
+            });
+        }
+
+        let option_type = buf[offset];
+        let length = buf[offset + 1];
+        if length == 0 {
+            return Err(Icmp6RsOptionParseError::ZeroLength { option_type });
+        }
+
+        let option_len = usize::from(length) * 8;
+        let next = offset + option_len;
+        if next > buf.len() {
+            return Err(Icmp6RsOptionParseError::TruncatedOption {
+                option_type,
+                option_len,
+                remaining: buf.len() - offset,
+            });
+        }
+
+        if option_type == Icmp6RouterSolicitation::OPTION_SLLA {
+            has_slla = true;
+        }
+        offset = next;
+    }
+
+    Ok(has_slla)
+}
+
 #[derive(Debug, thiserror::Error)]
-pub enum Icmp6RsFromWireError {
+pub enum Icmp6RsParseError {
     #[error("deserialization error: {0}")]
     Ispf(#[from] ispf::Error),
 
+    #[error("too short: {0} octets, expected at least 8")]
+    TooShort(usize),
+
+    #[error("invalid option: {0}")]
+    Option(#[from] Icmp6RsOptionParseError),
+
+    /// Source Link-Layer Address option is invalid from an unspecified source.
+    #[error("SLLA option is invalid from unspecified source")]
+    SllaFromUnspecifiedSource,
+
+    #[error("multicast source address is invalid for router solicitation: {0}")]
+    MulticastSource(Ipv6Addr),
+
     #[error("wrong type: expected {expected}, got {0}", expected = Icmp6RouterSolicitation::TYPE)]
     WrongType(u8),
 
     #[error("wrong code: expected {expected}, got {0}", expected = Icmp6RouterSolicitation::CODE)]
     WrongCode(u8),
 }
+
+#[derive(Debug, thiserror::Error)]
+pub enum Icmp6RsOptionParseError {
+    #[error("truncated option header: {remaining} octets remaining")]
+    TruncatedHeader { remaining: usize },
+
+    #[error("option {option_type} has zero length")]
+    ZeroLength { option_type: u8 },
+
+    #[error(
+        "option {option_type} length {option_len} exceeds {remaining} remaining octets"
+    )]
+    TruncatedOption {
+        option_type: u8,
+        option_len: usize,
+        remaining: usize,
+    },
+}