netdev - ping6 packets high probability loss occurs by the default firewalld rule(rpfilter invert) with low traffic generated by iperf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <96ac86f8-eb74-f3fc-ab23-5a97603fac82@huawei.com>
Date:   Sun, 3 Nov 2019 17:32:30 +0800
From:   hujunwei <hujunwei4@...wei.com>
To:     <dsahern@...il.com>, <davem@...emloft.net>, <kafai@...com>,
        <weiwan@...gle.com>
CC:     <netdev@...r.kernel.org>, <wangxiaogang3@...wei.com>,
        <xuhanbing@...wei.com>
Subject: ping6 packets high probability loss occurs by the default firewalld
 rule(rpfilter invert) with low traffic generated by iperf

Hi all,

In my systems, running v4.19.y longterm kernels, ping6 packets high probability loss occur by the default firewalld rule(rpfilter invert) with low traffic generated by iperf.
# ip6tables -nvL -t raw | grep rpfilter
7043  627K DROP       all      *      *       ::/0                 ::/0                 rpfilte invert

Follow these steps:
1) server
# ip -6 a a 2001:db8:0:f101::30/64 dev eth0
# service firewalld stop
# ./iperf3 -s -6

2) client
# ip -6 a a 2001:db8:0:f101::29/64 dev eth0
# ./iperf3 -6 -c 2001:0db8:0:f101::30 -t 3600 -l 4 M -P 5
# ping6 -i 0.2 -I 2001:0db8:0:f101::29 2001:0db8:0:f101::30 -c 100

# sar -n DEV 1 | grep eth0
03:59:41 PM  eth_eth0  38627.00  39353.00   3531.77   5863.12      0.00      0.00      0.00      0.48
03:59:42 PM  eth_eth0  40017.00  40010.00   3648.53   5931.89      0.00      0.00      0.00      0.49
03:59:43 PM  eth_eth0  40025.00  40013.00   3648.95   5977.62      0.00      0.00      0.00      0.49
03:59:44 PM  eth_eth0  39671.00  39657.00   3619.22   5898.70      0.00      0.00      0.00      0.48
03:59:45 PM  eth_eth0  37857.00  40093.00   3352.11   5857.46      0.00      0.00      0.00      0.48

# ping6 Result:
--- 2001:0db8:0:f101::30 ping statistics ---
100 packets transmitted, 64 received, 36% packet loss, time 20379ms

Afer debugging, I find that packet drop because system can't alloc ipv6 dst. when dst->pcpuc_entries exceed gc_thresh in dst_alloc() which called by rpfilter_lookup_reverse6().
When I increase gc_thresh, packets loss decreased, but I think it is unreasonable to lose packets by default firewalld rule with low traffic.

I have a question that why not check the percpu route first in ip6_pol_route_lookup() when rt6_find_cached_rt() retrun NULL, just like ip6_pol_route().
Can anyone help to answer this?
Thanks.