netdev - RE: [PATCH] neighbour: guarantee the localhost connections be established successfully even the ARP table is full

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: 
 <IA1PR19MB6545F5F1940C0B326058987ABB082@IA1PR19MB6545.namprd19.prod.outlook.com>
Date: Tue, 16 Apr 2024 10:36:23 +0000
From: "Li, James Zheng" <James.Z.Li@...l.com>
To: Eric Dumazet <edumazet@...gle.com>, Zheng Li <lizheng043@...il.com>
CC: "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "bpf@...r.kernel.org"
	<bpf@...r.kernel.org>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "jmorris@...ei.org" <jmorris@...ei.org>,
        "pabeni@...hat.com"
	<pabeni@...hat.com>,
        "kuba@...nel.org" <kuba@...nel.org>
Subject: RE: [PATCH] neighbour: guarantee the localhost connections be
 established successfully even the ARP table is full




Internal Use - Confidential
-----Original Message-----
From: Eric Dumazet <edumazet@...gle.com>
Sent: Tuesday, April 16, 2024 6:02 PM
To: Zheng Li <lizheng043@...il.com>
Cc: netdev@...r.kernel.org; bpf@...r.kernel.org; davem@...emloft.net; jmorris@...ei.org; pabeni@...hat.com; kuba@...nel.org; Li, James Zheng <James.Z.Li@...l.com>
Subject: Re: [PATCH] neighbour: guarantee the localhost connections be established successfully even the ARP table is full


[EXTERNAL EMAIL]

On Tue, Apr 16, 2024 at 11:54 AM Zheng Li <lizheng043@...il.com> wrote:
>
> From: Zheng Li <James.Z.Li@...l.com>
>
> Inter-process communication on localhost should be established
> successfully even the ARP table is full, many processes on server
> machine use the localhost to communicate such as command-line
> interface (CLI), servers hope all CLI commands can be executed
> successfully even the arp table is full. Right now CLI commands got
> timeout when the arp table is full. Set the parameter of
> exempt_from_gc to be true for LOOPBACK net device to keep localhost neigh in arp table, not removed by gc.
>
> the steps of reproduced:
> server with "gc_thresh3 = 1024" setting, ping server from more than
> 1024 same netmask Lan IPv4 addresses, run "ssh localhost" on console
> interface, then the command will get timeout.
>
> Signed-off-by: Zheng Li <James.Z.Li@...l.com>
> ---
>  net/core/neighbour.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/core/neighbour.c b/net/core/neighbour.c index
> 552719c3bbc3..47d07b122f7a 100644
> --- a/net/core/neighbour.c
> +++ b/net/core/neighbour.c
> @@ -734,7 +734,9 @@ ___neigh_create(struct neigh_table *tbl, const
> void *pkey,  struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
>                                  struct net_device *dev, bool
> want_ref)  {
> -       return ___neigh_create(tbl, pkey, dev, 0, false, want_ref);
> +       bool exempt_from_gc = !!(dev->flags & IFF_LOOPBACK);
> +
> +       return ___neigh_create(tbl, pkey, dev, 0, exempt_from_gc,
> + want_ref);
>  }
>  EXPORT_SYMBOL(__neigh_create);
>

> Hmmm...

> Loopback IPv4 can hold 2^24 different addresses, that is 16384 * 1024

There is only one Loopback neigh "0.0.0.0 dev lo lladdr 00:00:00:00:00:00 NOARP" existing even you have configured 2^24 different addresses on the loopback device.