lkml.org 
[lkml]   [2017]   [Jul]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.11 22/84] net: dont global ICMP rate limit packets originating from loopback
    Date
    4.11-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jesper Dangaard Brouer <brouer@redhat.com>


    [ Upstream commit 849a44de91636c24cea799cb8ad8c36433feb913 ]

    Florian Weimer seems to have a glibc test-case which requires that
    loopback interfaces does not get ICMP ratelimited. This was broken by
    commit c0303efeab73 ("net: reduce cycles spend on ICMP replies that
    gets rate limited").

    An ICMP response will usually be routed back-out the same incoming
    interface. Thus, take advantage of this and skip global ICMP
    ratelimit when the incoming device is loopback. In the unlikely event
    that the outgoing it not loopback, due to strange routing policy
    rules, ICMP rate limiting still works via peer ratelimiting via
    icmpv4_xrlim_allow(). Thus, we should still comply with RFC1812
    (section 4.3.2.8 "Rate Limiting").

    This seems to fix the reproducer given by Florian. While still
    avoiding to perform expensive and unneeded outgoing route lookup for
    rate limited packets (in the non-loopback case).

    Fixes: c0303efeab73 ("net: reduce cycles spend on ICMP replies that gets rate limited")
    Reported-by: Florian Weimer <fweimer@redhat.com>
    Reported-by: "H.J. Lu" <hjl.tools@gmail.com>
    Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv4/icmp.c | 8 ++++++--
    net/ipv6/icmp.c | 2 +-
    2 files changed, 7 insertions(+), 3 deletions(-)

    --- a/net/ipv4/icmp.c
    +++ b/net/ipv4/icmp.c
    @@ -674,8 +674,12 @@ void icmp_send(struct sk_buff *skb_in, i
    /* Needed by both icmp_global_allow and icmp_xmit_lock */
    local_bh_disable();

    - /* Check global sysctl_icmp_msgs_per_sec ratelimit */
    - if (!icmpv4_global_allow(net, type, code))
    + /* Check global sysctl_icmp_msgs_per_sec ratelimit, unless
    + * incoming dev is loopback. If outgoing dev change to not be
    + * loopback, then peer ratelimit still work (in icmpv4_xrlim_allow)
    + */
    + if (!(skb_in->dev && (skb_in->dev->flags&IFF_LOOPBACK)) &&
    + !icmpv4_global_allow(net, type, code))
    goto out_bh_enable;

    sk = icmp_xmit_lock(net);
    --- a/net/ipv6/icmp.c
    +++ b/net/ipv6/icmp.c
    @@ -491,7 +491,7 @@ static void icmp6_send(struct sk_buff *s
    local_bh_disable();

    /* Check global sysctl_icmp_msgs_per_sec ratelimit */
    - if (!icmpv6_global_allow(type))
    + if (!(skb->dev->flags&IFF_LOOPBACK) && !icmpv6_global_allow(type))
    goto out_bh_enable;

    mip6_addr_swap(skb);

    \
     
     \ /
      Last update: 2017-07-03 16:05    [W:4.521 / U:0.328 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site