Re: Limit the number of Router Advertisements processed on an interface
Dheeraj Kandula <[email protected]> Mon, 11 Jul 2022 15:51:40 -0400
| Newsgroups | gmane.linux.debian.devel.ipv6 |
|---|---|
| Message-ID | <CA+qNgxRYN5_say_FvzQb3Q_+QMcPuVC3HghW-nNe+UzEiv3Q_g@mail.gmail.com> |
--000000000000180ac405e38ce2ba Content-Type: text/plain; charset="UTF-8" Does a Linux machine know that a Router Advertisement didn't come from a default router? I tried to send 2 RA packets using Scapy with the destination as ff02::1. One packet I sent using the source address of the default router, while the other using a lower LLA. The default routes were not generated. How did Linux figure it out? Is there a way to know the errors that were hit? I don't know where the "ND_PRINTK" outputs go for the function "ndisc_router_discovery". How do I enable tracing for ND prints. I looked into "dmesg" but there were no logs there. Dheeraj On Wed, Jun 15, 2022 at 12:27 PM Dheeraj Kandula <[email protected]> wrote: > Thanks Marc. This is a requirement. > > Thus I will conclude that the kernel doesn't limit the number of RAs. I > have to figure out a way to do this from user space. > > Dheeraj > > On Wed, Jun 15, 2022 at 11:49 AM Marc Haber <[email protected]> > wrote: > >> On Wed, Jun 15, 2022 at 10:23:18AM -0400, Dheeraj Kandula wrote: >> > This is to avoid DOS attacks using RAs from being bombarded onto a linux >> > machine. >> >> You have malicious users on your LAN and cannot do anything against >> them? >> >> (RAs are link local communication and should not pass over routers, >> thus, RAs must originate in the local network). >> >> Greetings >> Marc >> >> -- >> >> ----------------------------------------------------------------------------- >> Marc Haber | "I don't trust Computers. They | Mailadresse im >> Header >> Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 >> 1600402 >> Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 >> 1600421 >> >> --000000000000180ac405e38ce2ba Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>Does a Linux machine know that a Router Advertisement= didn't come from a default router?</div><div><br></div><div>I tried to= send 2 RA packets using Scapy with the destination as ff02::1. One packet = I sent using the source address of the default router, while the other usin= g a lower LLA.</div><div><br></div><div>The default routes were not generat= ed. How did Linux figure it out? Is there a way to know the errors that wer= e hit? I don't know where the "ND_PRINTK" outputs go for the = function "ndisc_router_discovery". How do I enable tracing for ND= prints. I looked into "dmesg" but there were no logs there.</div= ><div><br></div><div><br></div><div>Dheeraj<br></div></div><br><div class= =3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, Jun 15, 2022= at 12:27 PM Dheeraj Kandula <<a href=3D"mailto:[email protected]">dkan= [email protected]</a>> wrote:<br></div><blockquote class=3D"gmail_quote" st= yle=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padd= ing-left:1ex"><div dir=3D"ltr"><div>Thanks Marc.=C2=A0 This is a requiremen= t.<br></div><div><br></div><div>Thus I will conclude that the kernel doesn&= #39;t limit the number of RAs. I have to figure out a way to do this from u= ser space.<br></div><div><br></div><div>Dheeraj<br></div></div><br><div cla= ss=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, Jun 15, 20= 22 at 11:49 AM Marc Haber <<a href=3D"mailto:mh%2Bdebian-ipv6@zugschlus.= de" target=3D"_blank">[email protected]</a>> wrote:<br></div><= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex">On Wed, Jun 15, 2022 at 10= :23:18AM -0400, Dheeraj Kandula wrote:<br> > This is to avoid DOS attacks using RAs from being bombarded onto a lin= ux<br> > machine.<br> <br> You have malicious users on your LAN and cannot do anything against<br> them?<br> <br> (RAs are link local communication and should not pass over routers,<br> thus, RAs must originate in the local network).<br> <br> Greetings<br> Marc<br> <br> -- <br> ---------------------------------------------------------------------------= --<br> Marc Haber=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| "I don't trust Compu= ters. They | Mailadresse im Header<br> Leimen, Germany=C2=A0 =C2=A0 |=C2=A0 lose things."=C2=A0 =C2=A0 Winona= Ryder | Fon: *49 6224 1600402<br> Nordisch by Nature |=C2=A0 How to make an American Quilt | Fax: *49 6224 16= 00421<br> <br> </blockquote></div> </blockquote></div> --000000000000180ac405e38ce2ba--