From fabea9c0926595322e79c8d9988f5b29b3b617ac Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Wed, 6 Sep 2023 00:44:42 +0900
Subject: [PATCH 1/2] network/ndisc: drop outdated PREF64 prefixes

Follow-up for 6e8f5e4c1f5fcdb3b63343268936f9c269b6a209.

Addresses https://github.com/systemd/systemd/pull/29009#issuecomment-1705741844.
---
 src/network/networkd-ndisc.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/network/networkd-ndisc.c b/src/network/networkd-ndisc.c
index e860650691..4038cd7347 100644
--- a/src/network/networkd-ndisc.c
+++ b/src/network/networkd-ndisc.c
@@ -1134,6 +1134,7 @@ static int ndisc_drop_outdated(Link *link, usec_t timestamp_usec) {
         NDiscDNSSL *dnssl;
         NDiscRDNSS *rdnss;
         NDiscCaptivePortal *cp;
+        NDiscPREF64 *p64;
         Address *address;
         Route *route;
         int r = 0, k;
@@ -1194,6 +1195,15 @@ static int ndisc_drop_outdated(Link *link, usec_t timestamp_usec) {
                 updated = true;
         }
 
+        SET_FOREACH(p64, link->ndisc_pref64) {
+                if (p64->lifetime_usec >= timestamp_usec)
+                        continue; /* the pref64 prefix is still valid */
+
+                free(set_remove(link->ndisc_pref64, p64));
+                /* The pref64 prefix is not exported through the state file, hence it is not necessary to set
+                 * the 'updated' flag. */
+        }
+
         if (updated)
                 link_dirty(link);
 
@@ -1220,6 +1230,7 @@ static int ndisc_setup_expire(Link *link) {
         NDiscCaptivePortal *cp;
         NDiscDNSSL *dnssl;
         NDiscRDNSS *rdnss;
+        NDiscPREF64 *p64;
         Address *address;
         Route *route;
         int r;
@@ -1256,6 +1267,9 @@ static int ndisc_setup_expire(Link *link) {
         SET_FOREACH(cp, link->ndisc_captive_portals)
                 lifetime_usec = MIN(lifetime_usec, cp->lifetime_usec);
 
+        SET_FOREACH(p64, link->ndisc_pref64)
+                lifetime_usec = MIN(lifetime_usec, p64->lifetime_usec);
+
         if (lifetime_usec == USEC_INFINITY)
                 return 0;
 

From 4df16cd018f2b47b73e68dc30c625f12187dc1aa Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Wed, 6 Sep 2023 00:55:42 +0900
Subject: [PATCH 2/2] network/ndisc: refuse too many PREF64 prefixes

Follow-up for 6e8f5e4c1f5fcdb3b63343268936f9c269b6a209.

Addresses https://github.com/systemd/systemd/pull/29009#issuecomment-1705700926.
---
 src/network/networkd-ndisc.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/network/networkd-ndisc.c b/src/network/networkd-ndisc.c
index 4038cd7347..f24f1f30fc 100644
--- a/src/network/networkd-ndisc.c
+++ b/src/network/networkd-ndisc.c
@@ -27,9 +27,12 @@
 
 #define NDISC_DNSSL_MAX 64U
 #define NDISC_RDNSS_MAX 64U
-/* Not defined RFC, but let's set an upper limit to make not consume much memory.
+/* Not defined in the RFC, but let's set an upper limit to make not consume much memory.
  * This should be safe as typically there should be at most 1 portal per network. */
 #define NDISC_CAPTIVE_PORTAL_MAX 64U
+/* Neither defined in the RFC. Just for safety. Otherwise, malformed messages can make clients trigger OOM.
+ * Not sure if the threshold is high enough. Let's adjust later if not. */
+#define NDISC_PREF64_MAX 64U
 
 bool link_ipv6_accept_ra_enabled(Link *link) {
         assert(link);
@@ -1051,6 +1054,11 @@ static int ndisc_router_process_pref64(Link *link, sd_ndisc_router *rt) {
                 return 0;
         }
 
+        if (set_size(link->ndisc_pref64) >= NDISC_PREF64_MAX) {
+                log_link_debug(link, "Too many PREF64 records received. Only first %u records will be used.", NDISC_PREF64_MAX);
+                return 0;
+        }
+
         new_entry = new(NDiscPREF64, 1);
         if (!new_entry)
                 return log_oom();