netdev - IPv6 routing table max_size badly dimensioned compared to IPv4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 27 Feb 2014 20:24:03 +0100
From:	bert hubert <bert.hubert@...herlabs.nl>
To:	netdev@...r.kernel.org
Subject: IPv6 routing table max_size badly dimensioned compared to IPv4

Hi everybody,

Today, a PowerDNS (open source dns, www.powerdns.com) deployment ran into
trouble with large amounts of IPv6 users.  It appears a large telco 'flicked
the switch'.  We had around 8000 DNS queries/s over IPv6, and everything
slowed to a crawl.  100% CPU utilization, most of it in the kernel. The same
amount of queries over IPv4 causes no problems.

Note, this system is not functioning as a router or anything. It is just
serving IPv6 DNS to a reasonable number of clients.

Thanks to diligent debugging and rapid help from friends over at SUSE, who
suggested setting net.ipv6.route.max_size to a higher than default value,
all problems were quickly resolved (thanks!).

>From a quick reading of ip6_dst_gc, it is obvious that exceeding the
max_size of the IPv6 routing table quickly becomes painful, causing non-stop
gc scans.

net.ipv6.route.max_size defaults to 4096. The equivalent setting for IPv4
defaults to 'millions' or is even dynamically sizing in modern kernels.

Now I know distributions can set this sysctl at will, but it appears that
many of them don't. It does appear odd that we still assume at a kernel
level that IPv6 is 'rare', a thousand times more rare than IPv4.

If people think this is a good idea, I could try to lift some of the other
'autosizing' code out there to get the IPv6 max_size limit raised on
non-contrained hardware. 

Please let me know!

-- 
PowerDNS Website: http://www.powerdns.com/
Contact us by phone on +31-15-7850372
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html