Re: [PATCH net] ipv6: tcp: drop silly ICMPv6 packet too big messages

On Wed, Jul 7, 2021 at 6:15 PM Willy Tarreau [off-list ref] wrote:

On Wed, Jul 07, 2021 at 06:06:21PM +0200, Eric Dumazet wrote:

quoted

On Wed, Jul 7, 2021 at 5:59 PM Willy Tarreau [off-list ref] wrote:

quoted

Hi Eric,

On Wed, Jul 07, 2021 at 08:46:30AM -0700, Eric Dumazet wrote:

quoted

From: Eric Dumazet <edumazet@google.com>

While TCP stack scales reasonably well, there is still one part that
can be used to DDOS it.

IPv6 Packet too big messages have to lookup/insert a new route,
and if abused by attackers, can easily put hosts under high stress,
with many cpus contending on a spinlock while one is stuck in fib6_run_gc()

Just thinking loud, wouldn't it make sense to support randomly dropping
such packets on input (or even better rate-limit them) ? After all, if
a host on the net feels like it will need to send one, it will surely
need to send a few more until one is taken into account so it's not
dramatic. And this could help significantly reduce their processing cost.

Not sure what you mean by random.

I just meant statistical randomness. E.g. drop 9/10 when under stress for
example.

It is hard to define ' stress'. In our case we were maybe receiving 10
ICMPv6 messages per second " only "

I would rather define the issue as a deficiency in current IPv6 stack vs routes.

One can hope that one day the issue will disappear.

quoted

We probably want to process valid packets, if they ever reach us.

That's indeed the other side of my question. I.e. if a server gets hit
by such a flood, do we consider more important to spend the CPU cycles
processing all received packets or can we afford dropping a lot of them.

quoted

In our case, we could simply drop all ICMPv6 " packet too big"
 messages, since we clamp TCP/IPv6 MSS to the bare minimum anyway.

Adding a generic check in TCP/ipv6 stack is cheaper than an iptables
rule (especially if this is the only rule that must be used)

Sure, I was not thinking about iptables here, rather a hard-coded
prandom_u32() call or a percpu cycling counter.

Willy