Solicit routers as long as RAs are handled

...to conform with Linux's `accept_ra` sysctl option.

```
  accept_ra - INTEGER
    Accept Router Advertisements; autoconfigure using them.

    It also determines whether or not to transmit Router
    Solicitations. If and only if the functional setting is to
    accept Router Advertisements, Router Solicitations will be
    transmitted.

    Possible values are:
      0 Do not accept Router Advertisements.
      1 Accept Router Advertisements if forwarding is disabled.
      2 Overrule forwarding behaviour. Accept Router Advertisements
        even if forwarding is enabled.

    Functional default: enabled if local forwarding is disabled.
                        disabled if local forwarding is enabled.
```

With this change, routers may be solicited even if the stack is has
forwarding enabled, as long as the interface is configured to handle
RAs when forwarding is enabled.

PiperOrigin-RevId: 372406501

3 files changed, 222 insertions, 132 deletions

diff --git a/pkg/tcpip/network/ipv6/ipv6.go b/pkg/tcpip/network/ipv6/ipv6.go
index c7a92be6c..659057fa7 100644
--- a/pkg/tcpip/network/ipv6/ipv6.go
+++ b/pkg/tcpip/network/ipv6/ipv6.go
@@ -420,8 +420,6 @@ func (e *endpoint) transitionForwarding(forwarding bool) {
 	defer e.mu.Unlock()
 
 	if forwarding {
-		e.mu.ndp.stopSolicitingRouters()
-
 		// As per RFC 4291 section 2.8:
 		//
 		//   A router is required to recognize all addresses that a host is
@@ -445,28 +443,19 @@ func (e *endpoint) transitionForwarding(forwarding bool) {
 				panic(fmt.Sprintf("e.joinGroupLocked(%s): %s", g, err))
 			}
 		}
-
-		return
-	}
-
-	for _, g := range allRoutersGroups {
-		switch err := e.leaveGroupLocked(g).(type) {
-		case nil:
-		case *tcpip.ErrBadLocalAddress:
-			// The endpoint may have already left the multicast group.
-		default:
-			panic(fmt.Sprintf("e.leaveGroupLocked(%s): %s", g, err))
+	} else {
+		for _, g := range allRoutersGroups {
+			switch err := e.leaveGroupLocked(g).(type) {
+			case nil:
+			case *tcpip.ErrBadLocalAddress:
+				// The endpoint may have already left the multicast group.
+			default:
+				panic(fmt.Sprintf("e.leaveGroupLocked(%s): %s", g, err))
+			}
 		}
 	}
 
-	// When transitioning into an IPv6 host, NDP router solicitations are
-	// started if the endpoint is enabled.
-	//
-	// If the endpoint is not currently enabled, routers will be solicited when
-	// the endpoint becomes enabled (if it is still a host).
-	if e.Enabled() {
-		e.mu.ndp.startSolicitingRouters()
-	}
+	e.mu.ndp.forwardingChanged(forwarding)
 }
 
 // Enable implements stack.NetworkEndpoint.
@@ -548,17 +537,7 @@ func (e *endpoint) Enable() tcpip.Error {
 		e.mu.ndp.doSLAAC(header.IPv6LinkLocalPrefix.Subnet(), header.NDPInfiniteLifetime, header.NDPInfiniteLifetime)
 	}
 
-	// If we are operating as a router, then do not solicit routers since we
-	// won't process the RAs anyway.
-	//
-	// Routers do not process Router Advertisements (RA) the same way a host
-	// does. That is, routers do not learn from RAs (e.g. on-link prefixes
-	// and default routers). Therefore, soliciting RAs from other routers on
-	// a link is unnecessary for routers.
-	if !e.protocol.Forwarding() {
-		e.mu.ndp.startSolicitingRouters()
-	}
-
+	e.mu.ndp.startSolicitingRouters()
 	return nil
 }
 
diff --git a/pkg/tcpip/network/ipv6/ndp.go b/pkg/tcpip/network/ipv6/ndp.go
index be6a2e161..b29fed347 100644
--- a/pkg/tcpip/network/ipv6/ndp.go
+++ b/pkg/tcpip/network/ipv6/ndp.go
@@ -334,10 +334,27 @@ func (c HandleRAsConfiguration) String() string {
 	}
 }
 
+// enabled returns true iff Router Advertisements may be handled given the
+// specified forwarding status.
+func (c HandleRAsConfiguration) enabled(forwarding bool) bool {
+	switch c {
+	case HandlingRAsDisabled:
+		return false
+	case HandlingRAsEnabledWhenForwardingDisabled:
+		return !forwarding
+	case HandlingRAsAlwaysEnabled:
+		return true
+	default:
+		panic(fmt.Sprintf("unhandled HandleRAsConfiguration = %d", c))
+	}
+}
+
 // NDPConfigurations is the NDP configurations for the netstack.
 type NDPConfigurations struct {
 	// The number of Router Solicitation messages to send when the IPv6 endpoint
 	// becomes enabled.
+	//
+	// Ignored unless configured to handle Router Advertisements.
 	MaxRtrSolicitations uint8
 
 	// The amount of time between transmitting Router Solicitation messages.
@@ -688,18 +705,9 @@ func (ndp *ndpState) handleRA(ip tcpip.Address, ra header.NDPRouterAdvert) {
 	// per-interface basis; it is a protocol-wide configuration, so we check the
 	// protocol's forwarding flag to determine if the IPv6 endpoint is forwarding
 	// packets.
-	switch ndp.configs.HandleRAs {
-	case HandlingRAsDisabled:
+	if !ndp.configs.HandleRAs.enabled(ndp.ep.protocol.Forwarding()) {
 		ndp.ep.stats.localStats.UnhandledRouterAdvertisements.Increment()
 		return
-	case HandlingRAsEnabledWhenForwardingDisabled:
-		if ndp.ep.protocol.Forwarding() {
-			ndp.ep.stats.localStats.UnhandledRouterAdvertisements.Increment()
-			return
-		}
-	case HandlingRAsAlwaysEnabled:
-	default:
-		panic(fmt.Sprintf("unhandled HandleRAs configuration = %d", ndp.configs.HandleRAs))
 	}
 
 	// Only worry about the DHCPv6 configuration if we have an NDPDispatcher as we
@@ -1686,6 +1694,10 @@ func (ndp *ndpState) cleanupState() {
 // startSolicitingRouters starts soliciting routers, as per RFC 4861 section
 // 6.3.7. If routers are already being solicited, this function does nothing.
 //
+// If ndp is not configured to handle Router Advertisements, routers will not
+// be solicited as there is no point soliciting routers if we don't handle their
+// advertisements.
+//
 // The IPv6 endpoint that ndp belongs to MUST be locked.
 func (ndp *ndpState) startSolicitingRouters() {
 	if ndp.rtrSolicitTimer.timer != nil {
@@ -1698,6 +1710,10 @@ func (ndp *ndpState) startSolicitingRouters() {
 		return
 	}
 
+	if !ndp.configs.HandleRAs.enabled(ndp.ep.protocol.Forwarding()) {
+		return
+	}
+
 	// Calculate the random delay before sending our first RS, as per RFC
 	// 4861 section 6.3.7.
 	var delay time.Duration
@@ -1790,6 +1806,32 @@ func (ndp *ndpState) startSolicitingRouters() {
 	}
 }
 
+// forwardingChanged handles a change in forwarding configuration.
+//
+// If transitioning to a host, router solicitation will be started. Otherwise,
+// router solicitation will be stopped if NDP is not configured to handle RAs
+// as a router.
+//
+// Precondition: ndp.ep.mu must be locked.
+func (ndp *ndpState) forwardingChanged(forwarding bool) {
+	if forwarding {
+		if ndp.configs.HandleRAs.enabled(forwarding) {
+			return
+		}
+
+		ndp.stopSolicitingRouters()
+		return
+	}
+
+	// Solicit routers when transitioning to a host.
+	//
+	// If the endpoint is not currently enabled, routers will be solicited when
+	// the endpoint becomes enabled (if it is still a host).
+	if ndp.ep.Enabled() {
+		ndp.startSolicitingRouters()
+	}
+}
+
 // stopSolicitingRouters stops soliciting routers. If routers are not currently
 // being solicited, this function does nothing.
 //
diff --git a/pkg/tcpip/stack/ndp_test.go b/pkg/tcpip/stack/ndp_test.go
index 011571106..c585b81b2 100644
--- a/pkg/tcpip/stack/ndp_test.go
+++ b/pkg/tcpip/stack/ndp_test.go
@@ -1147,7 +1147,10 @@ func raBufWithPI(ip tcpip.Address, rl uint16, prefix tcpip.AddressWithPrefix, on
 }
 
 func TestDynamicConfigurationsDisabled(t *testing.T) {
-	const nicID = 1
+	const (
+		nicID              = 1
+		maxRtrSolicitDelay = time.Second
+	)
 
 	prefix := tcpip.AddressWithPrefix{
 		Address:   testutil.MustParse6("102:304:506:708::"),
@@ -1206,7 +1209,12 @@ func TestDynamicConfigurationsDisabled(t *testing.T) {
 					}
 					ndpConfigs := test.config(enable)
 					ndpConfigs.HandleRAs = handle
+					ndpConfigs.MaxRtrSolicitations = 1
+					ndpConfigs.RtrSolicitationInterval = maxRtrSolicitDelay
+					ndpConfigs.MaxRtrSolicitationDelay = maxRtrSolicitDelay
+					clock := faketime.NewManualClock()
 					s := stack.New(stack.Options{
+						Clock: clock,
 						NetworkProtocols: []stack.NetworkProtocolFactory{ipv6.NewProtocolWithOptions(ipv6.Options{
 							NDPConfigs: ndpConfigs,
 							NDPDisp:    &ndpDisp,
@@ -1216,15 +1224,12 @@ func TestDynamicConfigurationsDisabled(t *testing.T) {
 						t.Fatalf("SetForwarding(%d, %t): %s", ipv6.ProtocolNumber, forwarding, err)
 					}
 
-					e := channel.New(0, 1280, linkAddr1)
+					e := channel.New(1, 1280, linkAddr1)
 					if err := s.CreateNIC(nicID, e); err != nil {
 						t.Fatalf("CreateNIC(%d, _): %s", nicID, err)
 					}
 
-					e.InjectInbound(header.IPv6ProtocolNumber, test.ra.Clone())
-
-					// Make sure that the unhandled RA stat is only incremented when RAs
-					// are configured to be unhandled.
+					handleRAsDisabled := handle == ipv6.HandlingRAsDisabled || forwarding
 					ep, err := s.GetNetworkEndpoint(nicID, ipv6.ProtocolNumber)
 					if err != nil {
 						t.Fatalf("s.GetNetworkEndpoint(%d, %d): %s", nicID, ipv6.ProtocolNumber, err)
@@ -1234,16 +1239,41 @@ func TestDynamicConfigurationsDisabled(t *testing.T) {
 					if !ok {
 						t.Fatalf("got v6Stats = %T, expected = %T", stats, v6Stats)
 					}
-					want := uint64(0)
-					if handle == ipv6.HandlingRAsDisabled || forwarding {
-						want = 1
+
+					// Make sure that when handling RAs are enabled, we solicit routers.
+					clock.Advance(maxRtrSolicitDelay)
+					if got, want := v6Stats.ICMP.PacketsSent.RouterSolicit.Value(), boolToUint64(!handleRAsDisabled); got != want {
+						t.Errorf("got v6Stats.ICMP.PacketsSent.RouterSolicit.Value() = %d, want = %d", got, want)
 					}
-					if got := v6Stats.UnhandledRouterAdvertisements.Value(); got != want {
-						t.Fatalf("got v6Stats.UnhandledRouterAdvertisements.Value() = %d, want = %d", got, want)
+					if handleRAsDisabled {
+						if p, ok := e.Read(); ok {
+							t.Errorf("unexpectedly got a packet = %#v", p)
+						}
+					} else if p, ok := e.Read(); !ok {
+						t.Error("expected router solicitation packet")
+					} else if p.Proto != header.IPv6ProtocolNumber {
+						t.Errorf("got Proto = %d, want = %d", p.Proto, header.IPv6ProtocolNumber)
+					} else {
+						if want := header.EthernetAddressFromMulticastIPv6Address(header.IPv6AllRoutersLinkLocalMulticastAddress); p.Route.RemoteLinkAddress != want {
+							t.Errorf("got remote link address = %s, want = %s", p.Route.RemoteLinkAddress, want)
+						}
+
+						checker.IPv6(t, stack.PayloadSince(p.Pkt.NetworkHeader()),
+							checker.SrcAddr(header.IPv6Any),
+							checker.DstAddr(header.IPv6AllRoutersLinkLocalMulticastAddress),
+							checker.TTL(header.NDPHopLimit),
+							checker.NDPRS(checker.NDPRSOptions(nil)),
+						)
 					}
 
-					// Make sure we did not discover any routers or prefixes, or perform
-					// SLAAC.
+					// Make sure we do not discover any routers or prefixes, or perform
+					// SLAAC on reception of an RA.
+					e.InjectInbound(header.IPv6ProtocolNumber, test.ra.Clone())
+					// Make sure that the unhandled RA stat is only incremented when
+					// handling RAs is disabled.
+					if got, want := v6Stats.UnhandledRouterAdvertisements.Value(), boolToUint64(handleRAsDisabled); got != want {
+						t.Errorf("got v6Stats.UnhandledRouterAdvertisements.Value() = %d, want = %d", got, want)
+					}
 					select {
 					case e := <-ndpDisp.routerC:
 						t.Errorf("unexpectedly discovered a router when configured not to: %#v", e)
@@ -1265,6 +1295,13 @@ func TestDynamicConfigurationsDisabled(t *testing.T) {
 	}
 }
 
+func boolToUint64(v bool) uint64 {
+	if v {
+		return 1
+	}
+	return 0
+}
+
 // Check e to make sure that the event is for addr on nic with ID 1, and the
 // discovered flag set to discovered.
 func checkRouterEvent(e ndpRouterEvent, addr tcpip.Address, discovered bool) string {
@@ -5299,96 +5336,127 @@ func TestRouterSolicitation(t *testing.T) {
 		},
 	}
 
+	subTests := []struct {
+		name         string
+		handleRAs    ipv6.HandleRAsConfiguration
+		afterFirstRS func(*testing.T, *stack.Stack)
+	}{
+		{
+			name:         "Handle RAs when forwarding disabled",
+			handleRAs:    ipv6.HandlingRAsEnabledWhenForwardingDisabled,
+			afterFirstRS: func(*testing.T, *stack.Stack) {},
+		},
+
+		// Enabling forwarding when RAs are always configured to be handled
+		// should not stop router solicitations.
+		{
+			name:      "Handle RAs always",
+			handleRAs: ipv6.HandlingRAsAlwaysEnabled,
+			afterFirstRS: func(t *testing.T, s *stack.Stack) {
+				if err := s.SetForwarding(ipv6.ProtocolNumber, true); err != nil {
+					t.Fatalf("SetForwarding(%d, true): %s", ipv6.ProtocolNumber, err)
+				}
+			},
+		},
+	}
+
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			clock := faketime.NewManualClock()
-			e := channelLinkWithHeaderLength{
-				Endpoint:     channel.New(int(test.maxRtrSolicit), 1280, test.linkAddr),
-				headerLength: test.linkHeaderLen,
-			}
-			e.Endpoint.LinkEPCapabilities |= stack.CapabilityResolutionRequired
-			waitForPkt := func(timeout time.Duration) {
-				t.Helper()
+			for _, subTest := range subTests {
+				t.Run(subTest.name, func(t *testing.T) {
+					clock := faketime.NewManualClock()
+					e := channelLinkWithHeaderLength{
+						Endpoint:     channel.New(int(test.maxRtrSolicit), 1280, test.linkAddr),
+						headerLength: test.linkHeaderLen,
+					}
+					e.Endpoint.LinkEPCapabilities |= stack.CapabilityResolutionRequired
+					waitForPkt := func(timeout time.Duration) {
+						t.Helper()
+
+						clock.Advance(timeout)
+						p, ok := e.Read()
+						if !ok {
+							t.Fatal("expected router solicitation packet")
+						}
 
-				clock.Advance(timeout)
-				p, ok := e.Read()
-				if !ok {
-					t.Fatal("expected router solicitation packet")
-				}
+						if p.Proto != header.IPv6ProtocolNumber {
+							t.Fatalf("got Proto = %d, want = %d", p.Proto, header.IPv6ProtocolNumber)
+						}
 
-				if p.Proto != header.IPv6ProtocolNumber {
-					t.Fatalf("got Proto = %d, want = %d", p.Proto, header.IPv6ProtocolNumber)
-				}
+						// Make sure the right remote link address is used.
+						if want := header.EthernetAddressFromMulticastIPv6Address(header.IPv6AllRoutersLinkLocalMulticastAddress); p.Route.RemoteLinkAddress != want {
+							t.Errorf("got remote link address = %s, want = %s", p.Route.RemoteLinkAddress, want)
+						}
 
-				// Make sure the right remote link address is used.
-				if want := header.EthernetAddressFromMulticastIPv6Address(header.IPv6AllRoutersLinkLocalMulticastAddress); p.Route.RemoteLinkAddress != want {
-					t.Errorf("got remote link address = %s, want = %s", p.Route.RemoteLinkAddress, want)
-				}
+						checker.IPv6(t, stack.PayloadSince(p.Pkt.NetworkHeader()),
+							checker.SrcAddr(test.expectedSrcAddr),
+							checker.DstAddr(header.IPv6AllRoutersLinkLocalMulticastAddress),
+							checker.TTL(header.NDPHopLimit),
+							checker.NDPRS(checker.NDPRSOptions(test.expectedNDPOpts)),
+						)
 
-				checker.IPv6(t, stack.PayloadSince(p.Pkt.NetworkHeader()),
-					checker.SrcAddr(test.expectedSrcAddr),
-					checker.DstAddr(header.IPv6AllRoutersLinkLocalMulticastAddress),
-					checker.TTL(header.NDPHopLimit),
-					checker.NDPRS(checker.NDPRSOptions(test.expectedNDPOpts)),
-				)
+						if l, want := p.Pkt.AvailableHeaderBytes(), int(test.linkHeaderLen); l != want {
+							t.Errorf("got p.Pkt.AvailableHeaderBytes() = %d; want = %d", l, want)
+						}
+					}
+					waitForNothing := func(timeout time.Duration) {
+						t.Helper()
 
-				if l, want := p.Pkt.AvailableHeaderBytes(), int(test.linkHeaderLen); l != want {
-					t.Errorf("got p.Pkt.AvailableHeaderBytes() = %d; want = %d", l, want)
-				}
-			}
-			waitForNothing := func(timeout time.Duration) {
-				t.Helper()
+						clock.Advance(timeout)
+						if p, ok := e.Read(); ok {
+							t.Fatalf("unexpectedly got a packet = %#v", p)
+						}
+					}
+					s := stack.New(stack.Options{
+						NetworkProtocols: []stack.NetworkProtocolFactory{ipv6.NewProtocolWithOptions(ipv6.Options{
+							NDPConfigs: ipv6.NDPConfigurations{
+								HandleRAs:               subTest.handleRAs,
+								MaxRtrSolicitations:     test.maxRtrSolicit,
+								RtrSolicitationInterval: test.rtrSolicitInt,
+								MaxRtrSolicitationDelay: test.maxRtrSolicitDelay,
+							},
+						})},
+						Clock: clock,
+					})
+					if err := s.CreateNIC(nicID, &e); err != nil {
+						t.Fatalf("CreateNIC(%d, _) = %s", nicID, err)
+					}
 
-				clock.Advance(timeout)
-				if p, ok := e.Read(); ok {
-					t.Fatalf("unexpectedly got a packet = %#v", p)
-				}
-			}
-			s := stack.New(stack.Options{
-				NetworkProtocols: []stack.NetworkProtocolFactory{ipv6.NewProtocolWithOptions(ipv6.Options{
-					NDPConfigs: ipv6.NDPConfigurations{
-						MaxRtrSolicitations:     test.maxRtrSolicit,
-						RtrSolicitationInterval: test.rtrSolicitInt,
-						MaxRtrSolicitationDelay: test.maxRtrSolicitDelay,
-					},
-				})},
-				Clock: clock,
-			})
-			if err := s.CreateNIC(nicID, &e); err != nil {
-				t.Fatalf("CreateNIC(%d, _) = %s", nicID, err)
-			}
+					if addr := test.nicAddr; addr != "" {
+						if err := s.AddAddress(nicID, header.IPv6ProtocolNumber, addr); err != nil {
+							t.Fatalf("AddAddress(%d, %d, %s) = %s", nicID, header.IPv6ProtocolNumber, addr, err)
+						}
+					}
 
-			if addr := test.nicAddr; addr != "" {
-				if err := s.AddAddress(nicID, header.IPv6ProtocolNumber, addr); err != nil {
-					t.Fatalf("AddAddress(%d, %d, %s) = %s", nicID, header.IPv6ProtocolNumber, addr, err)
-				}
-			}
+					// Make sure each RS is sent at the right time.
+					remaining := test.maxRtrSolicit
+					if remaining > 0 {
+						waitForPkt(test.effectiveMaxRtrSolicitDelay)
+						remaining--
+					}
 
-			// Make sure each RS is sent at the right time.
-			remaining := test.maxRtrSolicit
-			if remaining > 0 {
-				waitForPkt(test.effectiveMaxRtrSolicitDelay)
-				remaining--
-			}
+					subTest.afterFirstRS(t, s)
 
-			for ; remaining > 0; remaining-- {
-				if test.effectiveRtrSolicitInt > defaultAsyncPositiveEventTimeout {
-					waitForNothing(test.effectiveRtrSolicitInt - time.Nanosecond)
-					waitForPkt(time.Nanosecond)
-				} else {
-					waitForPkt(test.effectiveRtrSolicitInt)
-				}
-			}
+					for ; remaining > 0; remaining-- {
+						if test.effectiveRtrSolicitInt > defaultAsyncPositiveEventTimeout {
+							waitForNothing(test.effectiveRtrSolicitInt - time.Nanosecond)
+							waitForPkt(time.Nanosecond)
+						} else {
+							waitForPkt(test.effectiveRtrSolicitInt)
+						}
+					}
 
-			// Make sure no more RS.
-			if test.effectiveRtrSolicitInt > test.effectiveMaxRtrSolicitDelay {
-				waitForNothing(test.effectiveRtrSolicitInt)
-			} else {
-				waitForNothing(test.effectiveMaxRtrSolicitDelay)
-			}
+					// Make sure no more RS.
+					if test.effectiveRtrSolicitInt > test.effectiveMaxRtrSolicitDelay {
+						waitForNothing(test.effectiveRtrSolicitInt)
+					} else {
+						waitForNothing(test.effectiveMaxRtrSolicitDelay)
+					}
 
-			if got, want := s.Stats().ICMP.V6.PacketsSent.RouterSolicit.Value(), uint64(test.maxRtrSolicit); got != want {
-				t.Fatalf("got sent RouterSolicit = %d, want = %d", got, want)
+					if got, want := s.Stats().ICMP.V6.PacketsSent.RouterSolicit.Value(), uint64(test.maxRtrSolicit); got != want {
+						t.Fatalf("got sent RouterSolicit = %d, want = %d", got, want)
+					}
+				})
 			}
 		})
 	}
@@ -5486,6 +5554,7 @@ func TestStopStartSolicitingRouters(t *testing.T) {
 			s := stack.New(stack.Options{
 				NetworkProtocols: []stack.NetworkProtocolFactory{ipv6.NewProtocolWithOptions(ipv6.Options{
 					NDPConfigs: ipv6.NDPConfigurations{
+						HandleRAs:               ipv6.HandlingRAsEnabledWhenForwardingDisabled,
 						MaxRtrSolicitations:     maxRtrSolicitations,
 						RtrSolicitationInterval: interval,
 						MaxRtrSolicitationDelay: delay,