From: Andrew Zaborowski <andrew.zaborowski at intel.com>
To: ell at lists.01.org
Subject: [PATCH 15/17] netconfig: Set a limit on number of routes from ICMPv6
Date: Sat, 14 May 2022 00:47:11 +0200 [thread overview]
Message-ID: <20220513224713.1447773-15-andrew.zaborowski@intel.com> (raw)
In-Reply-To: 20220513224713.1447773-1-andrew.zaborowski@intel.com
[-- Attachment #1: Type: text/plain, Size: 1230 bytes --]
While some networks can be configured in a way that prevents rogue
Router Advertisements from reaching clients, add a very basic mechanism
to avoid a denial-of-service in such a case by limiting the number of
routes we track from RAs. This won't prevent the loss of routing but
might prevent OOM crashes or slowdowns.
---
ell/netconfig.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/ell/netconfig.c b/ell/netconfig.c
index 5bfd940..2c2001e 100644
--- a/ell/netconfig.c
+++ b/ell/netconfig.c
@@ -135,6 +135,8 @@ static unsigned int rtnl_use_count;
static struct l_queue *addr_wait_list;
static unsigned int rtnl_id;
+static const unsigned int max_icmp6_routes = 100;
+
static void netconfig_update_cleanup(struct l_netconfig *nc)
{
l_queue_clear(nc->addresses.added, NULL);
@@ -736,6 +738,9 @@ static struct netconfig_route_data *netconfig_add_icmp6_route(
struct netconfig_route_data *rd;
struct l_rtnl_route *rt;
+ if (l_queue_length(nc->icmp_route_data) >= max_icmp6_routes)
+ return NULL; /* TODO: log a warning the first time */
+
rt = netconfig_route_new(nc, AF_INET6, dst->address, dst->prefix_len,
gateway, RTPROT_RA);
if (L_WARN_ON(!rt))
--
2.32.0
next reply other threads:[~2022-05-13 22:47 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-13 22:47 Andrew Zaborowski [this message]
-- strict thread matches above, loose matches on Subject: below --
2022-05-13 14:55 [PATCH 15/17] netconfig: Set a limit on number of routes from ICMPv6 Andrew Zaborowski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220513224713.1447773-15-andrew.zaborowski@intel.com \
--to=ell@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).