kern/60490: netinet: ICMP_REDIRECT routes are unbounded

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60490
>Category:       kern
>Synopsis:       netinet: ICMP_REDIRECT routes are unbounded
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 23 20:45:01 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
The NetBSD Redirection, Icmp.
>Environment:
>Description:

	Back a decade or two ago, we added a bound on the number of
	dynamic routes that could be created with ICMP6_REDIRECT
	messages, based on similar changes in OpenBSD from KAME:

--- a/sys/netinet6/icmp6.c
+++ b/sys/netinet6/icmp6.c
@@ -2279,6 +2279,8 @@ icmp6_redirect_input(struct mbuf *m, int off)
 		 * (there will be additional hops, though).
 		 */
 		rtcount = rt_timer_count(icmp6_redirect_timeout_q);
+		if (0 <= ip6_maxdynroutes && rtcount >= ip6_maxdynroutes)
+			goto freeit;
 		if (0 <= icmp6_redirect_hiwat && rtcount > icmp6_redirect_hiwat)
 			return;
 		else if (0 <= icmp6_redirect_lowat &&

	(We also left older experimental icmp6_redirect_hiwat and
	icmp6_redirect_lowat variables around, even though nothing uses
	them; we should just delete those.)

	But we didn't do the same for IPv4 ICMP.  Perhaps we should, in
	order to avoid unbounded growth of the routing table.

	Forwarded to us by Chris Jarrett-Davies <chrisjd%openai.com@localhost>.

>How-To-Repeat:

	send a lot of ICMP_REDIRECT messages that pass various other
	kinds of validation

>Fix:

	new ip_maxdynroutes sysctl knob