From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E8E83C433B4 for ; Sat, 17 Apr 2021 07:28:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C56BC61029 for ; Sat, 17 Apr 2021 07:28:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231161AbhDQH2c (ORCPT ); Sat, 17 Apr 2021 03:28:32 -0400 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:51799 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229631AbhDQH2a (ORCPT ); Sat, 17 Apr 2021 03:28:30 -0400 Received: (from willy@localhost) by pcw.home.local (8.15.2/8.15.2/Submit) id 13H7RiqZ014175; Sat, 17 Apr 2021 09:27:44 +0200 Date: Sat, 17 Apr 2021 09:27:44 +0200 From: Willy Tarreau To: Eric Dumazet Cc: David Ahern , Florian Westphal , Keyu Man , "davem@davemloft.net" , "yoshfuji@linux-ipv6.org" , "dsahern@kernel.org" , Jakub Kicinski , "netdev@vger.kernel.org" , "linux-kernel@vger.kernel.org" , Zhiyun Qian Subject: Re: PROBLEM: DoS Attack on Fragment Cache Message-ID: <20210417072744.GB14109@1wt.eu> References: <02917697-4CE2-4BBE-BF47-31F58BC89025@hxcore.ol> <52098fa9-2feb-08ae-c24f-1e696076c3b9@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, Apr 17, 2021 at 06:44:40AM +0200, Eric Dumazet wrote: > On Sat, Apr 17, 2021 at 2:31 AM David Ahern wrote: > > > > [ cc author of 648700f76b03b7e8149d13cc2bdb3355035258a9 ] > > I think this has been discussed already. There is no strategy that > makes IP reassembly units immune to DDOS attacks. For having tried to deal with this in the past as well, I agree with this conclusion, which is also another good example of why fragments should really be avoided as much as possible over hostile networks. However I also found that random drops of previous entries is the approach which seems to offer the most statistical opportunities to legitimate traffic to still work under attack (albeit really poorly considering that any lost fragment requires retransmission of the whole series). In this case the chance for a packet to be successfully reassembled would vary proportionally to the inverse of its number of fragments, which reasonably limits the impact of attacks (without being an ultimate solution of course). > We added rb-tree and sysctls to let admins choose to use GB of RAM if > they really care. I agree that for those who care, the real solution is to make sure they can store all the traffic they receive during a reassembly period. Legitimate traffic mostly reassembles quickly so keeping 1 second of traffic at 10 Gbps is only 1.25 GB of RAM after all... Willy