On Sat, Apr 17, 2021 at 06:44:40AM +0200, Eric Dumazet wrote: > On Sat, Apr 17, 2021 at 2:31 AM David Ahern <dsah...@gmail.com> wrote: > > > > [ cc author of 648700f76b03b7e8149d13cc2bdb3355035258a9 ] > > I think this has been discussed already. There is no strategy that > makes IP reassembly units immune to DDOS attacks.
For having tried to deal with this in the past as well, I agree with this conclusion, which is also another good example of why fragments should really be avoided as much as possible over hostile networks. However I also found that random drops of previous entries is the approach which seems to offer the most statistical opportunities to legitimate traffic to still work under attack (albeit really poorly considering that any lost fragment requires retransmission of the whole series). In this case the chance for a packet to be successfully reassembled would vary proportionally to the inverse of its number of fragments, which reasonably limits the impact of attacks (without being an ultimate solution of course). > We added rb-tree and sysctls to let admins choose to use GB of RAM if > they really care. I agree that for those who care, the real solution is to make sure they can store all the traffic they receive during a reassembly period. Legitimate traffic mostly reassembles quickly so keeping 1 second of traffic at 10 Gbps is only 1.25 GB of RAM after all... Willy
