Re: ICMP6 Type2 with MTU=PrevMTU Packet Flood in specific cornercase scenarios on OpenBSD7.4

2024-03-08 Thread Tobias Fiebig
Moin, > I will also poke in the linux direction so they can fix their ICMP6 > rate limiting issue. Another FYI on this: Not ratelimiting ICMP6 Packet-too-big (Type 2) and Echo/Reply (Type 128/129) is the default setting in Linux, see Documentation/networking/ip-sysctl.rst l2776 of the Linux sour

Re: ICMP6 Type2 with MTU=PrevMTU Packet Flood in specific cornercase scenarios on OpenBSD7.4

2024-03-08 Thread Tobias Fiebig
Moin, quick follow-up: - I forgot to mention: pf should be off (or block return must be commented, at least) given the async routing going on for this to hit. - I just tested this with an added in linux, and it indeed leads to a packet storm, even though it is more fiddly to create the state where

Re: ICMP6 Type2 with MTU=PrevMTU Packet Flood in specific cornercase scenarios on OpenBSD7.4

2024-03-07 Thread Tobias Fiebig
Moin, ok, had a hunch, and i think i got closer to this. I can now semi- reproduce this in a lab environment. with six OpenBSD 7.4. I guess the last missing component is bringing in a Linux router, i.e., in a pure openbsd setup it is not that bad because openbsd does not send type 2 ad infinum (un

Re: ICMP6 Type2 with MTU=PrevMTU Packet Flood in specific cornercase scenarios on OpenBSD7.4

2024-03-07 Thread Tobias Fiebig
Moin > How does the route look like where the path MTU is saved? > netstat -rn has a Mtu column. Just noticed i sent route -n -T0 get instead of netstat -rn; gw02.dus01.as59645.net ~ # route -T0 exec netstat -rn | grep 2a06:d1c0::b 2a06:d1c0::b/1282a06:d1c0::dead:bee

Re: ICMP6 Type2 with MTU=PrevMTU Packet Flood in specific cornercase scenarios on OpenBSD7.4

2024-03-07 Thread Tobias Fiebig
Moin, > Note that I have also written some scapy script to test path MTU > discovery.  /usr/src/regress/sys/netinet/pmtu/tcp_connect.py > and tcp_connect6.py > Sometimes these tests fail, so PMTU may have bugs.  Or my tests are > just unreliable. Awesome, thanks! > How does the route look like

Re: ICMP6 Type2 with MTU=PrevMTU Packet Flood in specific cornercase scenarios on OpenBSD7.4

2024-03-07 Thread Alexander Bluhm
Hi, Thanks for the detailed bug report. Note that I have also written some scapy script to test path MTU discovery. /usr/src/regress/sys/netinet/pmtu/tcp_connect.py and tcp_connect6.py Sometimes these tests fail, so PMTU may have bugs. Or my tests are just unreliable. How does the route look l

ICMP6 Type2 with MTU=PrevMTU Packet Flood in specific cornercase scenarios on OpenBSD7.4

2024-03-07 Thread Tobias Fiebig
Moin, I have run into some issues with v6 PMTUD on OpenBSD 7.4, and am somewhat at a loss on how to proceed finding a proper reproducer. I first brushed into MTU issues when some of my mailers suddenly started to put out ~50mbit of traffic with no apparent reason. Back then further debugging lead