Fwd: proper ICMPv6 syntax for specific daddr

Fwd: proper ICMPv6 syntax for specific daddr

[Tom]

On 2022-09-07 11:25, Pablo Neira Ayuso wrote:
> On Wed, Sep 07, 2022 at 11:22:24AM -0400, Tom wrote:
>> table ip6 filter {
>> 	set ping6 {
>> 		typeof ip6 daddr . meta l4proto
>> 		limit rate 5/second
>> 		elements = { xxxx:43:a:83::2 . ipv6-icmp limit rate 5/second,
>> 			     xxxx:43:a:83::3 . ipv6-icmp limit rate 5/second,
>> 			     xxxx:43:a:83::4 . ipv6-icmp limit rate 5/second }
>> 	}
>> 	chain input {
>> 		type filter hook input priority filter; policy drop;
>> 		ip6 daddr . meta l4proto @ping6 accept
>> 	}
>>
>> Is this OK?
> 
> My recommendation is to use concatenations and sets, not to ratelimit
> _all_ icmpv6 traffic ;-)

Now I'm confused. I'd like to avoid ping floods if possible, but I can't seem to get the syntax right, so:
table ip6 filter {
	set ping6 {
		typeof ip6 daddr . meta l4proto
		elements = { xxxx:43:a:83::2 . ipv6-icmp,
			     xxxx:43:a:83::3 . ipv6-icmp,
			     xxxx:43:a:83::4 . ipv6-icmp }
	}
	chain input {
		type filter hook input priority filter; policy drop;
		ip6 daddr . meta l4proto @ping6 accept
	}
}

... will work for now. If anyone can show me the correct syntax to enable ping6 rate limiting without crippling icmpv6, please do!

Re: Fwd: proper ICMPv6 syntax for specific daddr

[Reindl Harald]

Am 07.09.22 um 17:57 schrieb Tom:
> Now I'm confused. I'd like to avoid ping floods if possible

but that makes no sense when doing more harm than good - the knee-jerk 
reaction kill all icmp is a problem for decades even on IPv4 but will no 
longer work with IPv6

> but I can't 
> seem to get the syntax right, so:
> enable ping6 rate limiting without crippling icmpv6, please do!

one of the responses contained "Please use 'icmpv6 type { echo-request, 
echo-reply}'"

why do you make all that so complicated instead write a simple ratelimit 
rule for ping apply to everyone and *before* have a set which ACCEPTs a 
specific list of ip's if that's needed at all

"I'd like to avoid ping floods if possible" don't scale at all with a 
manually maintained list of source ips and i can't think of anybody with 
a justification of more than 5 pings per second

Re: proper ICMPv6 syntax for specific daddr

[Tom]

On 2022-09-08 04:46, Reindl Harald wrote:
> Am 07.09.22 um 17:57 schrieb Tom:
>> Now I'm confused. I'd like to avoid ping floods if possible
> but that makes no sense when doing more harm than good - the knee-jerk reaction kill all icmp is a problem for decades even on IPv4 but will no longer work with IPv6

Who said I wanted to kill all ICMP? Isn't it obvious that I'm trying to write a rule that allows it?

>> but I can't seem to get the syntax right, so:
>> enable ping6 rate limiting without crippling icmpv6, please do!

> one of the responses contained "Please use 'icmpv6 type { echo-request, echo-reply}'"

Yes I saw that. As I pointed out, I can't get the syntax right which specifies type in a set and also limits rates. That's why I dropped rate limits.
  
> why do you make all that so complicated instead write a simple ratelimit rule for ping apply to everyone and *before* have a set which ACCEPTs a specific list of ip's if that's needed at all

OK, sounds good. Perhaps you're under the mistaken impression I'm a NFT expert. Clearly I'm not. Perhaps you could suggest a resource where I might find examples which solve my problem. Better yet, you could provide a practical example. It would be appreciated.

> "I'd like to avoid ping floods if possible" don't scale at all with a manually maintained list of source ips and i can't think of anybody with a justification of more than 5 pings per second

Except they're not source IPs, They are destination IPs. The server has multiple IP addresses. I am not limiting which IPs can ping, I'm limiting which of the server IPs they can ping to.

Re: proper ICMPv6 syntax for specific daddr

[Reindl Harald]

Am 08.09.22 um 15:31 schrieb Tom:
> On 2022-09-08 04:46, Reindl Harald wrote:
>> why do you make all that so complicated instead write a simple 
>> ratelimit rule for ping apply to everyone and *before* have a set 
>> which ACCEPTs a specific list of ip's if that's needed at all
> 
> OK, sounds good. Perhaps you're under the mistaken impression I'm a NFT 
> expert. Clearly I'm not. Perhaps you could suggest a resource where I 
> might find examples which solve my problem. Better yet, you could 
> provide a practical example. It would be appreciated

in a rulset any rule which is final (DROP, JEJECT, ACCEPT) skips 
anything below

so you have a chain where you send only ICMP, write first the specific 
rules and at last one the "everything else" decision not matter if it's 
ACCEPT/DROP/REJECT

i use iptables-nft because i hate the new syntax and have thousands of 
lines in scripts for configure and dispaly status of rulesets - but the 
principles are the same for every firewall

Re: Fwd: proper ICMPv6 syntax for specific daddr

[Pablo Neira Ayuso]

On Wed, Sep 07, 2022 at 11:57:16AM -0400, Tom wrote:
> On 2022-09-07 11:25, Pablo Neira Ayuso wrote:
> > On Wed, Sep 07, 2022 at 11:22:24AM -0400, Tom wrote:
> > > table ip6 filter {
> > > 	set ping6 {
> > > 		typeof ip6 daddr . meta l4proto
> > > 		limit rate 5/second
> > > 		elements = { xxxx:43:a:83::2 . ipv6-icmp limit rate 5/second,
> > > 			     xxxx:43:a:83::3 . ipv6-icmp limit rate 5/second,
> > > 			     xxxx:43:a:83::4 . ipv6-icmp limit rate 5/second }
> > > 	}
> > > 	chain input {
> > > 		type filter hook input priority filter; policy drop;
> > > 		ip6 daddr . meta l4proto @ping6 accept
> > > 	}
> > > 
> > > Is this OK?
> > 
> > My recommendation is to use concatenations and sets, not to ratelimit
> > _all_ icmpv6 traffic ;-)
> 
> Now I'm confused. I'd like to avoid ping floods if possible, but I can't seem to get the syntax right, so:
> table ip6 filter {
> 	set ping6 {
> 		typeof ip6 daddr . meta l4proto

you removed the limit line in the set declaration ?

> 		elements = { xxxx:43:a:83::2 . ipv6-icmp,
> 			     xxxx:43:a:83::3 . ipv6-icmp,
> 			     xxxx:43:a:83::4 . ipv6-icmp }
> 	}
> 	chain input {
> 		type filter hook input priority filter; policy drop;
> 		ip6 daddr . meta l4proto @ping6 accept
> 	}
> }

If you would like to throttle icmpv6 echo-request, the::

table ip6 filter {
        set ping6 {
                typeof ip6 daddr . icmpv6 type
                limit rate 5/second
                elements = { aaaa:43:a:83::2 . echo-request,
                             aaaa:43:a:83::3 . echo-request,
                             aaaa:43:a:83::4 . echo-request }
        }
        chain input {
                type filter hook input priority filter; policy drop;
                ip6 daddr . icmpv6 type @ping6 accept
        }
}

Please, see the wiki for more examples on concatenations and sets/maps.

Re: Fwd: proper ICMPv6 syntax for specific daddr

[Tom]

On 2022-09-08 11:13, Pablo Neira Ayuso wrote:
> you removed the limit line in the set declaration ?

Yes, after I failed to get the right syntax to combine it with the ICMP type.

> If you would like to throttle icmpv6 echo-request, the::
> 
> table ip6 filter {
>          set ping6 {
>                  typeof ip6 daddr . icmpv6 type
>                  limit rate 5/second
>                  elements = { aaaa:43:a:83::2 . echo-request,
>                               aaaa:43:a:83::3 . echo-request,
>                               aaaa:43:a:83::4 . echo-request }
>          }
>          chain input {
>                  type filter hook input priority filter; policy drop;
>                  ip6 daddr . icmpv6 type @ping6 accept
>          }
> }

Thanks. I wouldn't have found that syntax in a quintillion years.

> Please, see the wiki for more examples on concatenations and sets/maps.

I've gone through it. As someone who's been programming and configuring computers for over forty years, I can tell you that the wiki documentation is not good. It seems to be written by and for nft developers.

Re: Fwd: proper ICMPv6 syntax for specific daddr

[Pablo Neira Ayuso]

On Thu, Sep 08, 2022 at 11:43:01AM -0400, Tom wrote:
> On 2022-09-08 11:13, Pablo Neira Ayuso wrote:
> > you removed the limit line in the set declaration ?
> 
> Yes, after I failed to get the right syntax to combine it with the ICMP type.
> 
> > If you would like to throttle icmpv6 echo-request, the::
> > 
> > table ip6 filter {
> >          set ping6 {
> >                  typeof ip6 daddr . icmpv6 type
> >                  limit rate 5/second
> >                  elements = { aaaa:43:a:83::2 . echo-request,
> >                               aaaa:43:a:83::3 . echo-request,
> >                               aaaa:43:a:83::4 . echo-request }
> >          }
> >          chain input {
> >                  type filter hook input priority filter; policy drop;
> >                  ip6 daddr . icmpv6 type @ping6 accept
> >          }
> > }
> 
> Thanks. I wouldn't have found that syntax in a quintillion years.

It was the same as the example I posted, I just replaced 'meta l4proto' by
'icmpv6 type' ;-)

> > Please, see the wiki for more examples on concatenations and sets/maps.
> 
> I've gone through it. As someone who's been programming and
> configuring computers for over forty years, I can tell you that the
> wiki documentation is not good. It seems to be written by and for
> nft developers.

Documentation can always be improved, it got better over time. We have
a good number of contributors that are not developers.