Skip to content

Commit df4d925

Browse files
strssndktndavem330
authored andcommitted
ipv4: try to cache dst_entries which would cause a redirect
Not caching dst_entries which cause redirects could be exploited by hosts on the same subnet, causing a severe DoS attack. This effect aggravated since commit f886497 ("ipv4: fix dst race in sk_dst_get()"). Lookups causing redirects will be allocated with DST_NOCACHE set which will force dst_release to free them via RCU. Unfortunately waiting for RCU grace period just takes too long, we can end up with >1M dst_entries waiting to be released and the system will run OOM. rcuos threads cannot catch up under high softirq load. Attaching the flag to emit a redirect later on to the specific skb allows us to cache those dst_entries thus reducing the pressure on allocation and deallocation. This issue was discovered by Marcelo Leitner. Cc: Julian Anastasov <ja@ssi.bg> Signed-off-by: Marcelo Leitner <mleitner@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 412d290 commit df4d925

File tree

3 files changed

+13
-10
lines changed

3 files changed

+13
-10
lines changed

Diff for: include/net/ip.h

+6-5
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,12 @@ struct inet_skb_parm {
3939
struct ip_options opt; /* Compiled IP options */
4040
unsigned char flags;
4141

42-
#define IPSKB_FORWARDED 1
43-
#define IPSKB_XFRM_TUNNEL_SIZE 2
44-
#define IPSKB_XFRM_TRANSFORMED 4
45-
#define IPSKB_FRAG_COMPLETE 8
46-
#define IPSKB_REROUTED 16
42+
#define IPSKB_FORWARDED BIT(0)
43+
#define IPSKB_XFRM_TUNNEL_SIZE BIT(1)
44+
#define IPSKB_XFRM_TRANSFORMED BIT(2)
45+
#define IPSKB_FRAG_COMPLETE BIT(3)
46+
#define IPSKB_REROUTED BIT(4)
47+
#define IPSKB_DOREDIRECT BIT(5)
4748

4849
u16 frag_max_size;
4950
};

Diff for: net/ipv4/ip_forward.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,8 @@ int ip_forward(struct sk_buff *skb)
129129
* We now generate an ICMP HOST REDIRECT giving the route
130130
* we calculated.
131131
*/
132-
if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb_sec_path(skb))
132+
if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr &&
133+
!skb_sec_path(skb))
133134
ip_rt_send_redirect(skb);
134135

135136
skb->priority = rt_tos2priority(iph->tos);

Diff for: net/ipv4/route.c

+5-4
Original file line numberDiff line numberDiff line change
@@ -1554,11 +1554,10 @@ static int __mkroute_input(struct sk_buff *skb,
15541554

15551555
do_cache = res->fi && !itag;
15561556
if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
1557+
skb->protocol == htons(ETH_P_IP) &&
15571558
(IN_DEV_SHARED_MEDIA(out_dev) ||
1558-
inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) {
1559-
flags |= RTCF_DOREDIRECT;
1560-
do_cache = false;
1561-
}
1559+
inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
1560+
IPCB(skb)->flags |= IPSKB_DOREDIRECT;
15621561

15631562
if (skb->protocol != htons(ETH_P_IP)) {
15641563
/* Not IP (i.e. ARP). Do not create route, if it is
@@ -2303,6 +2302,8 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
23032302
r->rtm_flags = (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
23042303
if (rt->rt_flags & RTCF_NOTIFY)
23052304
r->rtm_flags |= RTM_F_NOTIFY;
2305+
if (IPCB(skb)->flags & IPSKB_DOREDIRECT)
2306+
r->rtm_flags |= RTCF_DOREDIRECT;
23062307

23072308
if (nla_put_be32(skb, RTA_DST, dst))
23082309
goto nla_put_failure;

0 commit comments

Comments
 (0)