Bug#932769: [moreinfo] DoS via DHCP request

[Tomas Pospisek <tpo_deb@sourcepole.ch>]

One more question. When you say VNWare integrated product. AFAIK vmware 
have their own networking module in the kernel? Can you reproduce this 
with some other virtualisation technology like kvm, qemu?

And one more question: do depending on who does the DHCP receival in the 
VM (systemd? isc-dhcp-client? [...]?): shouldn't there be some rate 
limiting sanity check in the DHCP client?
*t

On Tue, 23 Jul 2019, Tomas Pospisek wrote:

> Package: general
> Followup-For: Bug #932769
>
> Could you privide a recipe on how to reproduce this? There's a lot of
> very special setup below, that someone wwould need large amounts of time
> to reporoduce I feel.
>
> Is it possible to reduce the problem to something easily demonstratable?
>
> This seems to be an important issue to me.
>
> I think the problem here *might* be a kernel problem? Re-assign this to
> kernel package?
>
> When you say that it DoS'es the server then what does "top" say? What is
> being DoS'ed? Is it the CPU?
> *t
>
> It would be truly cool, if you could provide more infos.
> *t
>
> > To: Debian Bug Tracking System <submit@bugs.debian.org>
> > Subject: general: DHCP request bug when storage lost
> > Date: Mon, 22 Jul 2019 14:48:00 -0600
> >
> > Package: general
> > Severity: important
> > Tags: l10n
> >
> > Dear Maintainer,
> >
> > While doing unrelated storage testing for our VMware integrated product, we purposefully recreated
> > a storage outage by removing the iSCSI initiators from the backing array hosting the vmdk disk
> > images for the virtual machine.
> >
> > Upon removal of uplinks to storage, the VM goes into a R/O file system state after 5-10 minutes.
> > When storage initiators are brought back up and the LUNs are rescanned, the VM begins to
> > rapidly request DHCP leases from an ISC DHCP server.  This DoS's the server in a way due
> > to the number of DHCPDECLINE errors, and the interface attempts to take and discard IP's in a
> > rapid fashion.
> >
> > This only seems to appear on this distribution, and I can't replicate the behavior on Debian 9
> > or in a desktop environment.
> >
> >
> >
> > -- System Information:
> > Debian Release: 10.0
> >   APT prefers stable
> >   APT policy: (500, 'stable')
> > Architecture: amd64 (x86_64)
> >
> > Kernel: Linux 4.19.0-5-amd64 (SMP w/1 CPU core)
> > Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
> > Shell: /bin/sh linked to /usr/bin/dash
> > Init: systemd (via /run/systemd/system)
> > LSM: AppArmor: enabled
>
>
>
>
>
> -- System Information:
> Debian Release: 10.0
>  APT prefers stable
>  APT policy: (500, 'stable')
> Architecture: amd64 (x86_64)
> Foreign Architectures: i386
>
> Kernel: Linux 4.19.0-5-amd64 (SMP w/8 CPU cores)
> Locale: LANG=de_CH.utf8, LC_CTYPE=de_CH.utf8 (charmap=UTF-8), LANGUAGE=de_CH:de (charmap=UTF-8)
> Shell: /bin/sh linked to /bin/dash
> Init: systemd (via /run/systemd/system)
> LSM: AppArmor: enabled