• Paolo Abeni's avatar
    net: ipv4: really enforce backoff for redirects · 57644431
    Paolo Abeni authored
    In commit b406472b ("net: ipv4: avoid mixed n_redirects and
    rate_tokens usage") I missed the fact that a 0 'rate_tokens' will
    bypass the backoff algorithm.
    
    Since rate_tokens is cleared after a redirect silence, and never
    incremented on redirects, if the host keeps receiving packets
    requiring redirect it will reply ignoring the backoff.
    
    Additionally, the 'rate_last' field will be updated with the
    cadence of the ingress packet requiring redirect. If that rate is
    high enough, that will prevent the host from generating any
    other kind of ICMP messages
    
    The check for a zero 'rate_tokens' value was likely a shortcut
    to avoid the more complex backoff algorithm after a redirect
    silence period. Address the issue checking for 'n_redirects'
    instead, which is incremented on successful redirect, and
    does not interfere with other ICMP replies.
    
    Fixes: b406472b ("net: ipv4: avoid mixed n_redirects and rate_tokens usage")
    Reported-and-tested-by: default avatarColin Walters <walters@redhat.com>
    Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
    Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    57644431
route.c 89.2 KB