[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#932769: [moreinfo] DoS via DHCP request



On Tue, 23 Jul 2019 19:32:04 -0600 Mark Hutchison
<mark.hutchison89@gmail.com> wrote:

> When I look at systemctl for the dhclient service, I can see that there's
> an error, "can't create /var/lib/dhcp/dhclient.intname.leases Read Only
> file system", and then the DHCPREQUEST > DHCPACK > DHCPDECLINE sequence
> starts every few seconds, and occasionally the service will show "RTNETLINK
> answers: File Exists."
> 
> I'm guessing from the error that dhclient has a problem with not being able
> to read / write to the client leases file, declines the IP and requests
> another, but secretly holds on to the IP.

> I see that someone reported this similar bug back in 2018 as well, I think
> they may be the same thing.
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=888209
> 
> Thanks, just let me know if you have any questions.

To confirm your findings: We saw the same as well with isc-dhcp-client.
As soon as the filesystem its lease file resides on becomes unreachable
or read-only, it throws a fit and just hammers away at the DHCP
infrastructure.

In our case every client has a fixed DHCP reservation and only ever gets
OFFERed the same IP, which he then declines, but when you have several
hundred clients flooding DHCP reequests at the same time, the load on
the infrastructure, including switches with DHCP Snooping active, is
immense.

I also think that #888209 is the same issue.

Coincidentally it also happened in out VMware cluster when an
iSCSI-backed LUN when down but you should be easily able to reproduce
this with a simple local KVM setup.

Grüße,
Sven.

Attachment: signature.asc
Description: OpenPGP digital signature


Reply to: