diff options
| author | Eric Dumazet <edumazet@google.com> | 2026-02-16 14:28:32 +0000 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-02-18 16:46:37 -0800 |
| commit | 9395b1bb1f14ae3fa1e4e2f7988f029cb1c009ed (patch) | |
| tree | 09e7f57da5b7dff3303ebaa33babb4baff8a2efe | |
| parent | d8d9ef29886733428470655f2f99bc7493589fcb (diff) | |
ipv6: icmp: icmpv6_xrlim_allow() optimization if net.ipv6.icmp.ratelimit is zero
If net.ipv6.icmp.ratelimit is zero we do not have to call
inet_getpeer_v6() and inet_peer_xrlim_allow().
Both can be very expensive under DDOS.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260216142832.3834174-6-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | net/ipv6/icmp.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c index 0f41ca6f3d83..813d2e9edb8b 100644 --- a/net/ipv6/icmp.c +++ b/net/ipv6/icmp.c @@ -220,8 +220,12 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type, int tmo = READ_ONCE(net->ipv6.sysctl.icmpv6_time); struct inet_peer *peer; - peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr); - res = inet_peer_xrlim_allow(peer, tmo); + if (!tmo) { + res = true; + } else { + peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr); + res = inet_peer_xrlim_allow(peer, tmo); + } } rcu_read_unlock(); if (!res) |