|author||Alexander V. Chernikov <melifaro@FreeBSD.org>||2021-01-11 19:50:21 +0000|
|committer||Alexander V. Chernikov <melifaro@FreeBSD.org>||2021-01-11 19:51:11 +0000|
Bump amount of queued packets in for unresolved ARP/NDP entries to 16.
Currently default behaviour is to keep only 1 packet per unresolved entry. Ability to queue more than one packet was added 10 years ago, in r215207, though the default value was kep intact. Things have changed since that time. Systems tend to initiate multiple connections at once for a variety of reasons. For example, recent kern/252278 bug report describe happy-eyeball DNS behaviour sending multiple requests to the DNS server. The primary driver for upper value for the queue length determination is memory consumption. Remote actors should not be able to easily exhaust local memory by sending packets to unresolved arp/ND entries. For now, bump value to 16 packets, to match Darwin implementation. The proper approach would be to switch the limit to calculate memory consumption instead of packet count and limit based on memory. We should MFC this with a variation of D22447. Reviewers: #manpages, #network, bz, emaste Reviewed By: emaste, gbe(doc), jilles(doc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D28068
3 files changed, 9 insertions, 20 deletions
diff --git a/sys/netinet/if_ether.c b/sys/netinet/if_ether.c
index 972701369d13..e09ad3d47382 100644
@@ -114,7 +114,7 @@ VNET_PCPUSTAT_SYSINIT(arpstat);
#endif /* VIMAGE */
-VNET_DEFINE_STATIC(int, arp_maxhold) = 1;
+VNET_DEFINE_STATIC(int, arp_maxhold) = 16;
#define V_arpt_keep VNET(arpt_keep)
#define V_arpt_down VNET(arpt_down)
diff --git a/sys/netinet6/nd6.c b/sys/netinet6/nd6.c
index 5b66375e6613..386eb7cca922 100644
@@ -106,7 +106,7 @@ VNET_DEFINE_STATIC(int, nd6_maxndopt) = 10; /* max # of ND options allowed */
VNET_DEFINE(int, nd6_maxnudhint) = 0; /* max # of subsequent upper
* layer hints */
-VNET_DEFINE_STATIC(int, nd6_maxqueuelen) = 1; /* max pkts cached in unresolved
+VNET_DEFINE_STATIC(int, nd6_maxqueuelen) = 16; /* max pkts cached in unresolved
* ND entries */
#define V_nd6_maxndopt VNET(nd6_maxndopt)
#define V_nd6_maxqueuelen VNET(nd6_maxqueuelen)
diff --git a/usr.sbin/arp/arp.4 b/usr.sbin/arp/arp.4
index f13af95778a8..c9c9002cf908 100644
@@ -40,9 +40,7 @@
The Address Resolution Protocol (ARP) is used to dynamically
map between Protocol Addresses (such as IP addresses) and
Local Network Addresses (such as Ethernet addresses).
-This implementation maps IP addresses to Ethernet,
-or Token Ring addresses.
+This implementation maps IP addresses to Ethernet addresses.
It is used by all the Ethernet interface drivers.
ARP caches Internet-Ethernet address mappings.
@@ -51,9 +49,10 @@ ARP queues the message which requires the mapping and broadcasts
a message on the associated network requesting the address mapping.
If a response is provided, the new mapping is cached and any pending
message is transmitted.
-ARP will queue at most one packet while waiting for a response to a
-only the most recently ``transmitted'' packet is kept.
+ARP will queue at most
+packets while waiting for a response to a mapping request;
+only the most recently ``transmitted'' packets are kept.
If the target host does not respond after several requests,
the host is considered to be down allowing an error to be returned to
@@ -65,17 +64,7 @@ for a non-responding destination host, and
for a non-responding router.
-The ARP cache is stored in the system routing table as
-dynamically-created host routes.
-The route to a directly-attached Ethernet network is installed as a
-route (one with the
-causing routes to individual hosts on that network to be created on
-These routes time out periodically (normally 20 minutes after validated;
-entries are not validated when not in use).
+The ARP cache is stored in per-interface link-level table.
ARP entries may be added, deleted or changed with the
.Xr arp 8
@@ -173,7 +162,7 @@ Default is 1200 seconds.
.It Va maxhold
How many packets to hold in the per-entry output queue while the entry
is being resolved.
-Default is one packet.
+Default is 16 packets.
.It Va maxtries
Number of retransmits before a host is considered down and an error is