Hi All,
Is it possible to limit the number of Router Advertisements that will
be processed on an interface or on a Linux device as a whole (either granularity is fine)?
*For example*, if an interface receives more than 200 RAs within a time interval, only the first 200 will be processed.

There are sysctls to *disable* RA completely. i.e. net.ipv6.conf.default.accept_ra=0,

Disable processing Default routes: net.ipv6.conf.default.accept_ra_defrtr=0

Disable processing Prefix: net.ipv6.conf.default.accept_ra_pinfo=0.

But I want to enable the above 3 functionalities but limit the number of
them being processed.

*Why?*
This is to avoid DOS attacks using RAs from being bombarded onto a linux machine.

Dheeraj

<div dir="ltr"><div>Hi All,</div><div>     Is it possible to limit the number of Router Advertisements that will be processed on an interface or on a Linux device as a whole (either granularity is fine)?</div><div><b>For example</b>, if an interface
receives more than 200 RAs within a time interval, only the first 200 will be processed.</div><div><br></div><div>There are sysctls to <b>disable</b> RA completely. i.e. <br></div><div>net.ipv6.conf.default.accept_ra=0,<br></div><div><br></div><div>
Disable processing Default routes: net.ipv6.conf.default.accept_ra_defrtr=0</div><div><br></div><div>Disable processing Prefix: net.ipv6.conf.default.accept_ra_pinfo=0.</div><div><br></div><div>But I want to enable the above 3 functionalities but limit
the number of them being processed.<br></div><div><br></div><div><b>Why?</b><br></div><div>This is to avoid DOS attacks using RAs from being bombarded onto a linux machine.</div><div><br></div><div>Dheeraj<br></div></div>

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Dheeraj Kandula <dkandula@gmail.com> wrote:
> *Why?*
> This is to avoid DOS attacks using RAs from being bombarded onto a linux
> machine.

Well, you might be able to rate limit them with ip6tables/nftables, but I see no point in only listening to the first X of them. You might as well just disable them and configure a static IPv6.

You should also check out "RAGuard" functionality on your L2 switch.
RFC6105.


-----BEGIN PGP SIGNATURE-----

iQFFBAEBCgAvFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmKqASURHG1jckBzYW5k ZWxtYW4uY2EACgkQgItw+93Q3WXWjAf9GUteQR1ZARLr4PkEngVFZjX9893y0Ul7 jHMJzHH2q+bQDffiiGLqOojf5NOm2BDoLj24B5vB53D8BjovytwvD38LOrpwk+Ts pr6Bj8Rd5qk8Dhv+2IL/lSCrse+BbxPpjtvDakO+fXhcWD3C/eYaKhjFjV5qqFob PZ2p6fuNxtnKJTa1PS3rre63jRqYZYKoColQgyASTPwukTO7MdLGlm/Xlaa55anz +6RiH3xwWYr4c1VKKSi2gcNDwL/zR7jOtiS6moh6KXtb2JzPfBHo4C7bMrxR7Ft7 x33dE2TO/HmOLGri9kSl/mz6wH6XNBI4bOTT5vqtIQU2KproXO+dsg==
=T60x
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Wed, Jun 15, 2022 at 10:23:18AM -0400, Dheeraj Kandula wrote:

This is to avoid DOS attacks using RAs from being bombarded onto a linux machine.

You have malicious users on your LAN and cannot do anything against
them?

(RAs are link local communication and should not pass over routers,
thus, RAs must originate in the local network).

Greetings
Marc

-- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 1600402 Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Thanks Marc. This is a requirement.

Thus I will conclude that the kernel doesn't limit the number of RAs. I
have to figure out a way to do this from user space.

Dheeraj

On Wed, Jun 15, 2022 at 11:49 AM Marc Haber <mh+debian-ipv6@zugschlus.de> wrote:

On Wed, Jun 15, 2022 at 10:23:18AM -0400, Dheeraj Kandula wrote:

This is to avoid DOS attacks using RAs from being bombarded onto a linux machine.

You have malicious users on your LAN and cannot do anything against
them?

(RAs are link local communication and should not pass over routers,
thus, RAs must originate in the local network).

Greetings
Marc

--

----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 1600402 Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421

<div dir="ltr"><div>Thanks Marc.  This is a requirement.<br></div><div><br></div><div>Thus I will conclude that the kernel doesn&#39;t limit the number of RAs. I have to figure out a way to do this from user space.<br></div><div><br></div><div>Dheeraj<

</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jun 15, 2022 at 11:49 AM Marc Haber &lt;<a href="mailto:mh%2Bdebian-ipv6@zugschlus.de">mh+debian-ipv6@zugschlus.de</a>&gt; wrote:<br></div><blockquote class="gmail_

quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Wed, Jun 15, 2022 at 10:23:18AM -0400, Dheeraj Kandula wrote:<br>
&gt; This is to avoid DOS attacks using RAs from being bombarded onto a linux<br>
&gt; machine.<br>

You have malicious users on your LAN and cannot do anything against<br> them?<br>

(RAs are link local communication and should not pass over routers,<br>
thus, RAs must originate in the local network).<br>

Greetings<br>
Marc<br>

-- <br> -----------------------------------------------------------------------------<br>
Marc Haber         | &quot;I don&#39;t trust Computers. They | Mailadresse im Header<br>
Leimen, Germany    |  lose things.&quot;    Winona Ryder | Fon: *49 6224 1600402<br>
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421<br>

</blockquote></div>

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Does a Linux machine know that a Router Advertisement didn't come from a default router?

I tried to send 2 RA packets using Scapy with the destination as ff02::1.
One packet I sent using the source address of the default router, while the other using a lower LLA.

The default routes were not generated. How did Linux figure it out? Is
there a way to know the errors that were hit? I don't know where the "ND_PRINTK" outputs go for the function "ndisc_router_discovery". How do I enable tracing for ND prints. I looked into "dmesg" but there were no logs there.


Dheeraj

On Wed, Jun 15, 2022 at 12:27 PM Dheeraj Kandula <dkandula@gmail.com> wrote:

Thanks Marc. This is a requirement.

Thus I will conclude that the kernel doesn't limit the number of RAs. I
have to figure out a way to do this from user space.

Dheeraj

On Wed, Jun 15, 2022 at 11:49 AM Marc Haber <mh+debian-ipv6@zugschlus.de> wrote:

On Wed, Jun 15, 2022 at 10:23:18AM -0400, Dheeraj Kandula wrote:

This is to avoid DOS attacks using RAs from being bombarded onto a linux >> > machine.

You have malicious users on your LAN and cannot do anything against
them?

(RAs are link local communication and should not pass over routers,
thus, RAs must originate in the local network).

Greetings
Marc

--

-----------------------------------------------------------------------------
Marc Haber | "I don't trust Computers. They | Mailadresse im
Header
Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224
1600402
Nordisch by Nature | How to make an American Quilt | Fax: *49 6224
1600421

<div dir="ltr"><div>Does a Linux machine know that a Router Advertisement didn&#39;t come from a default router?</div><div><br></div><div>I tried to send 2 RA packets using Scapy with the destination as ff02::1. One packet I sent using the source address
of the default router, while the other using a lower LLA.</div><div><br></div><div>The default routes were not generated. How did Linux figure it out? Is there a way to know the errors that were hit? I don&#39;t know where the &quot;ND_PRINTK&quot;
outputs go for the function &quot;ndisc_router_discovery&quot;. How do I enable tracing for ND prints. I looked into &quot;dmesg&quot; but there were no logs there.</div><div><br></div><div><br></div><div>Dheeraj<br></div></div><br><div class="gmail_
quote"><div dir="ltr" class="gmail_attr">On Wed, Jun 15, 2022 at 12:27 PM Dheeraj Kandula &lt;<a href="mailto:dkandula@gmail.com">dkandula@gmail.com</a>&gt; wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px
solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Thanks Marc.  This is a requirement.<br></div><div><br></div><div>Thus I will conclude that the kernel doesn&#39;t limit the number of RAs. I have to figure out a way to do this from user
space.<br></div><div><br></div><div>Dheeraj<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jun 15, 2022 at 11:49 AM Marc Haber &lt;<a href="mailto:mh%2Bdebian-ipv6@zugschlus.de" target="_blank">mh+debian-ipv6@
zugschlus.de</a>&gt; wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Wed, Jun 15, 2022 at 10:23:18AM -0400, Dheeraj Kandula wrote:<br>
&gt; This is to avoid DOS attacks using RAs from being bombarded onto a linux<br>
&gt; machine.<br>

You have malicious users on your LAN and cannot do anything against<br> them?<br>

(RAs are link local communication and should not pass over routers,<br>
thus, RAs must originate in the local network).<br>

Greetings<br>
Marc<br>

-- <br> -----------------------------------------------------------------------------<br>
Marc Haber         | &quot;I don&#39;t trust Computers. They | Mailadresse im Header<br>
Leimen, Germany    |  lose things.&quot;    Winona Ryder | Fon: *49 6224 1600402<br>
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421<br>

</blockquote></div>
</blockquote></div>

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)