Tom Herbert
47d3d7ac65
ipv6: Implement limits on Hop-by-Hop and Destination options ...
RFC 8200 (IPv6) defines Hop-by-Hop options and Destination options
extension headers. Both of these carry a list of TLVs which is
only limited by the maximum length of the extension header (2048
bytes). By the spec a host must process all the TLVs in these
options, however these could be used as a fairly obvious
denial of service attack. I think this could in fact be
a significant DOS vector on the Internet, one mitigating
factor might be that many FWs drop all packets with EH (and
obviously this is only IPv6) so an Internet wide attack might not
be so effective (yet!).
By my calculation, the worse case packet with TLVs in a standard
1500 byte MTU packet that would be processed by the stack contains
1282 invidual TLVs (including pad TLVS) or 724 two byte TLVs. I
wrote a quick test program that floods a whole bunch of these
packets to a host and sure enough there is substantial time spent
in ip6_parse_tlv. These packets contain nothing but unknown TLVS
(that are ignored), TLV padding, and bogus UDP header with zero
payload length.
25.38% [kernel] [k] __fib6_clean_all
21.63% [kernel] [k] ip6_parse_tlv
4.21% [kernel] [k] __local_bh_enable_ip
2.18% [kernel] [k] ip6_pol_route.isra.39
1.98% [kernel] [k] fib6_walk_continue
1.88% [kernel] [k] _raw_write_lock_bh
1.65% [kernel] [k] dst_release
This patch adds configurable limits to Destination and Hop-by-Hop
options. There are three limits that may be set:
- Limit the number of options in a Hop-by-Hop or Destination options
extension header.
- Limit the byte length of a Hop-by-Hop or Destination options
extension header.
- Disallow unrecognized options in a Hop-by-Hop or Destination
options extension header.
The limits are set in corresponding sysctls:
ipv6.sysctl.max_dst_opts_cnt
ipv6.sysctl.max_hbh_opts_cnt
ipv6.sysctl.max_dst_opts_len
ipv6.sysctl.max_hbh_opts_len
If a max_*_opts_cnt is less than zero then unknown TLVs are disallowed.
The number of known TLVs that are allowed is the absolute value of
this number.
If a limit is exceeded when processing an extension header the packet is
dropped.
Default values are set to 8 for options counts, and set to INT_MAX
for maximum length. Note the choice to limit options to 8 is an
arbitrary guess (roughly based on the fact that the stack supports
three HBH options and just one destination option).
These limits have being proposed in draft-ietf-6man-rfc6434-bis.
Tested (by Martin Lau)
I tested out 1 thread (i.e. one raw_udp process).
I changed the net.ipv6.max_dst_(opts|hbh)_number between 8 to 2048.
With sysctls setting to 2048, the softirq% is packed to 100%.
With 8, the softirq% is almost unnoticable from mpstat.
v2;
- Code and documention cleanup.
- Change references of RFC2460 to be RFC8200.
- Add reference to RFC6434-bis where the limits will be in standard.
Signed-off-by: Tom Herbert <tom@quantonium.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-11-03 09:50:22 +09:00
9p: Implement show_options
2017-07-11 06:08:58 -04:00
Bluetooth: Use bt_dev_err and bt_dev_info when possible
2017-10-30 12:25:45 +02:00
netfilter: nat: Revert "netfilter: nat: convert nat bysrc hash to rhashtable"
2017-09-08 18:55:50 +02:00
ipv6: Implement limits on Hop-by-Hop and Destination options
2017-11-03 09:50:22 +09:00
NFC: Add nfc_dbg() macro
2017-04-05 10:15:20 +02:00
net: phonet: mark phonet_protocol as const
2017-10-07 23:15:08 +01:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-10-30 21:09:24 +09:00
sched: act: ife: update parameters via rcu handling
2017-10-12 22:23:03 -07:00
6lowpan: Fix IID format for Bluetooth
2017-04-12 22:02:36 +02:00
net: sched: introduce per-egress action device callbacks
2017-10-11 20:15:43 -07:00
net: display hw address of source machine during ipv6 DAD failure
2017-11-01 20:53:49 +09:00
rxrpc: Provide functions for allowing cleaner handling of signals
2017-10-18 11:42:48 +01:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-07-21 03:38:43 +01:00
VSOCK: use TCP state constants for sk_state
2017-10-05 18:44:17 -07:00
net: convert neighbour.refcnt from atomic_t to refcount_t
2017-07-01 07:39:07 -07:00
net, ax25: convert ax25_cb.refcount from atomic_t to refcount_t
2017-07-04 22:35:19 +01:00
bonding: Prevent duplicate userspace notification
2017-05-27 18:51:41 -04:00
bonding: remove rtmsg_ifinfo called after bond_lower_state_changed
2017-10-25 10:54:39 +09:00
net: fix compilation when busy poll is not enabled
2017-08-11 14:59:24 -07:00
net, calipso: convert calipso_doi.refcount from atomic_t to refcount_t
2017-07-04 22:35:16 +01:00
cfg80211/nl80211: add a port authorized event
2017-10-02 14:08:27 +02:00
csum: eliminate sparse warning in remcsum_unadjust()
2017-01-20 12:12:13 -05:00
net, ipv4: convert cipso_v4_doi.refcount from atomic_t to refcount_t
2017-07-04 01:29:04 -07:00
devlink: Add IPv6 header for dpipe
2017-08-31 14:42:19 -07:00
net/decnet: Convert timers to use timer_setup()
2017-10-18 12:39:36 +01:00
net, decnet: convert dn_fib_info.fib_clntref from atomic_t to refcount_t
2017-07-04 22:35:15 +01:00
net/decnet: Convert timers to use timer_setup()
2017-10-18 12:39:36 +01:00
net: dsa: remove port masks
2017-10-28 00:00:09 +09:00
net: updating dst lastusage is an unlikely event.
2017-10-27 11:52:52 +09:00
bpf: don't rely on the verifier lock for metadata_dst allocation
2017-10-10 12:30:16 -07:00
net: add confirm_neigh method to dst_ops
2017-02-07 13:07:46 -05:00
gre: introduce native tunnel support for ERSPAN
2017-08-22 14:29:30 -07:00
esp6: Reorganize esp_output
2017-04-14 10:06:42 +02:00
net: Add extack to fib_notifier_info
2017-11-01 11:50:43 +09:00
net: fib_rules: Implement notification logic in core
2017-08-03 15:35:59 -07:00
net: Extend struct flowi6 with multipath hash
2017-08-24 18:21:17 -07:00
flow_dissector: Cleanup control flow
2017-09-05 11:40:08 -07:00
fq: support filtering a given tin
2017-10-11 09:49:34 +02:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-10-30 21:09:24 +09:00
net_sched: gen_estimator: complete rewrite of rate estimators
2016-12-05 15:21:59 -05:00
genetlink: remove ops_list from genetlink header.
2017-06-05 10:54:55 -04:00
gro_cells: move to net/core/gro_cells.c
2017-02-08 14:38:18 -05:00
wireless: radiotap: rewrite the radiotap header file
2017-01-25 16:00:33 +01:00
net, ipv6: convert ifacaddr6.aca_refcnt from atomic_t to refcount_t
2017-07-04 01:29:04 -07:00
net: Introduce ife encapsulation module
2017-02-03 15:16:45 -05:00
inet: drop ->bind_conflict
2017-01-18 13:04:28 -05:00
net: ipv6: add second dif to inet6 socket lookups
2017-08-07 11:39:22 -07:00
net: Work around lockdep limitation in sockets that use sockets
2017-03-09 18:23:27 -08:00
inet/connection_sock: Convert timers to use timer_setup()
2017-10-18 12:39:55 +01:00
net-ipv6: remove unused IP6_ECN_clear() function
2017-10-01 17:55:54 -07:00
inet: frags: Convert timers to use timer_setup()
2017-10-18 12:39:55 +01:00
net: ipv4: add second dif to inet socket lookups
2017-08-07 11:39:21 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-10-30 21:09:24 +09:00
ipv4: Namespaceify tcp_tw_recycle and tcp_max_tw_buckets knob
2016-12-29 11:38:31 -05:00
inetpeer: remove AVL implementation in favor of RB tree
2017-07-17 08:59:01 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-08-21 17:06:42 -07:00
ipv6: take care of rt6_stats
2017-10-07 21:22:58 +01:00
ipv6: prepare fib6_age() for exception table
2017-10-07 21:22:57 +01:00
ip6_tunnel: Allow policy-based routing through tunnels
2017-04-21 13:21:30 -04:00
net: ipv4: remove fib_weight
2017-09-29 06:19:32 +01:00
ipv4: speedup ipv6 tunnels dismantle
2017-09-19 16:32:24 -07:00
ipvs: remove unused function ip_vs_set_state_timeout
2017-04-28 12:00:10 +02:00
ipv6: Implement limits on Hop-by-Hop and Destination options
2017-11-03 09:50:22 +09:00
net, ipx: convert ipx_route.refcnt from atomic_t to refcount_t
2017-07-04 22:35:17 +01:00
wext: uninline stream addition functions
2017-01-13 09:38:42 +01:00
net: ipv4: Do not drop to make_route if oif is l3mdev
2016-10-13 12:05:26 -04:00
net, lapb: convert lapb_cb.refcnt from atomic_t to refcount_t
2017-07-04 22:35:16 +01:00
net, llc: convert llc_sap.refcnt from atomic_t to refcount_t
2017-07-04 22:35:15 +01:00
net: LLC: Convert timers to use timer_setup()
2017-10-25 12:06:25 +09:00
net: add extack arg to lwtunnel build state
2017-05-30 11:55:32 -04:00
mac80211: add documentation to ieee80211_rx_ba_offl()
2017-09-21 11:42:00 +02:00
openvswitch: use mpls_hdr
2016-10-03 02:00:22 -04:00
net: mpls: Increase max number of labels for lwt encap
2017-04-01 20:21:44 -07:00
net/ncsi: fix ncsi_vlan_rx_{add,kill}_vid references
2017-09-05 09:11:45 -07:00
net: convert neighbour.refcnt from atomic_t to refcount_t
2017-07-01 07:39:07 -07:00
neigh: make strucrt neigh_table::entry_size unsigned int
2017-09-25 20:36:17 -07:00
net: core: Make the FIB notification chain generic
2017-08-03 15:35:59 -07:00
net: convert netlbl_lsm_cache.refcount from atomic_t to refcount_t
2017-07-01 07:39:09 -07:00
netlink: fix nla_put_{u8,u16,u32} for KASAN
2017-09-25 20:18:27 -07:00
net, netrom: convert nr_node.refcount from atomic_t to refcount_t
2017-07-04 22:35:17 +01:00
net: add NSH header structures and helpers
2017-08-29 15:16:52 -07:00
net: sched: remove ndo_setup_tc check from tc_can_offload
2017-11-02 16:10:39 +09:00
net/sched: Add support for HW offloading for CBS
2017-10-27 09:49:24 -07:00
IPv4: early demux can return an error code
2017-10-01 03:55:47 +01:00
net: Introduce psample, a new genetlink channel for packet sampling
2017-01-24 13:44:28 -05:00
net: ipv4: add second dif to raw socket lookups
2017-08-07 11:39:21 -07:00
net: ipv6: add second dif to raw socket lookups
2017-08-07 11:39:22 -07:00
ktime: Get rid of the union
2016-12-25 17:21:22 +01:00
tcp: socket option to set TCP fast open key
2017-10-20 13:21:36 +01:00
udp: perform source validation for mcast early demux
2017-10-01 03:55:47 +01:00
rtnetlink: remove __rtnl_af_unregister
2017-10-04 10:33:59 -07:00
net: sched: Identify hardware traffic classes using classid
2017-10-31 10:45:45 -07:00
sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>
2017-03-02 08:42:31 +01:00
tcp: Namespaceify sysctl_tcp_timestamps
2017-06-08 10:53:29 -04:00
ipv6: sr: add support for ip4ip6 encapsulation
2017-08-25 17:10:23 -07:00
ipv6: sr: add core files for SR HMAC support
2016-11-09 20:40:06 -05:00
smc: netlink interface for SMC sockets
2017-01-09 16:07:41 -05:00
net/sock: Update sk rcu iterator macro.
2017-10-24 18:46:22 +09:00
strparser: Use delayed work instead of timer for msg timeout
2017-10-25 10:37:11 +09:00
net: bridge: Notify on bridge device mrouter state changes
2017-10-09 10:18:11 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-11-02 15:23:39 +09:00
tls: kernel TLS support
2017-06-15 12:12:40 -04:00
net: define the TSO header size in net/tso.h
2017-08-23 20:42:09 -07:00
vxlan: factor out VXLAN-GPE next protocol
2017-08-29 15:16:52 -07:00
IPv4: early demux can return an error code
2017-10-01 03:55:47 +01:00
net: add infrastructure to un-offload UDP tunnel port
2017-07-24 13:52:59 -07:00
udp: use a separate rx queue for packet reception
2017-05-16 15:41:29 -04:00
vxlan: factor out VXLAN-GPE next protocol
2017-08-29 15:16:52 -07:00
dev_ioctl: copy only the smaller struct iwreq for wext
2017-06-14 13:52:44 +02:00
net, x25: convert x25_neigh.refcnt from atomic_t to refcount_t
2017-07-04 22:35:18 +01:00
xfrm: make xfrm_replay_state_esn_len() return unsigned int
2017-09-25 07:14:06 +02:00
47d3d7ac65