icmp: add a global rate limitation

Current ICMP rate limiting uses inetpeer cache, which is an RBL tree
protected by a lock, meaning that hosts can be stuck hard if all cpus
want to check ICMP limits.

When say a DNS or NTP server process is restarted, inetpeer tree grows
quick and machine comes to its knees.

iptables can not help because the bottleneck happens before ICMP
messages are even cooked and sent.

This patch adds a new global limitation, using a token bucket filter,
controlled by two new sysctl :

icmp_msgs_per_sec - INTEGER
    Limit maximal number of ICMP packets sent per second from this host.
    Only messages whose type matches icmp_ratemask are
    controlled by this limit.
    Default: 1000

icmp_msgs_burst - INTEGER
    icmp_msgs_per_sec controls number of ICMP packets sent per second,
    while icmp_msgs_burst controls the burst size of these packets.
    Default: 50

Note that if we really want to send millions of ICMP messages per
second, we might extend idea and infra added in commit 04ca6973f7c1a
("ip: make IP identifiers less predictable") :
add a token bucket in the ip_idents hash and no longer rely on inetpeer.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 12 insertions, 8 deletions

diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 394bb824fe4b..141e1f3ab74e 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -170,11 +170,11 @@ static bool is_ineligible(const struct sk_buff *skb)
 /*
  * Check the ICMP output rate limit
  */
-static inline bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
-                                      struct flowi6 *fl6)
+static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
+                               struct flowi6 *fl6)
 {
-        struct dst_entry *dst;
         struct net *net = sock_net(sk);
+        struct dst_entry *dst;
         bool res = false;
 
         /* Informational messages are not limited. */
@@ -199,16 +199,20 @@ static inline bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
         } else {
                 struct rt6_info *rt = (struct rt6_info *)dst;
                 int tmo = net->ipv6.sysctl.icmpv6_time;
-                struct inet_peer *peer;
 
                 /* Give more bandwidth to wider prefixes. */
                 if (rt->rt6i_dst.plen < 128)
                         tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
 
-                peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
-                res = inet_peer_xrlim_allow(peer, tmo);
-                if (peer)
-                        inet_putpeer(peer);
+                if (icmp_global_allow()) {
+                        struct inet_peer *peer;
+
+                        peer = inet_getpeer_v6(net->ipv6.peers,
+                                               &rt->rt6i_dst.addr, 1);
+                        res = inet_peer_xrlim_allow(peer, tmo);
+                        if (peer)
+                                inet_putpeer(peer);
+                }
         }
         dst_release(dst);
         return res;