ip,ip6: add rate limiting for ICMP errors, ARP and ICMP input

Under a flood of bad packets (TTL=1, no-route, etc.), every packet
triggers expensive ICMP error construction: address lookups, header
prepend with potential memmove, and checksum computation. Similarly, ARP
and ICMP/ICMPv6 input processing can saturate the control plane thread
when flooded. None of this is rate limited today.

Add a per-node token bucket to all ICMP error nodes, ARP input, and
ICMP/ICMPv6 input nodes. The bucket refills once per second and the
check runs before any per-packet work. When the bucket is empty, the
whole vector is moved to a dedicated drop node via
rte_node_next_stream_move(), avoiding any unnecessary processing.

Three separate rates are configurable via the graph config API:
icmp-error-rate, arp-rate and icmp-rate. All default to 1000 packets/sec
per node per worker. Setting a rate to 0 disables the limit. Rate
changes take effect immediately without graph reload.

Signed-off-by: Robin Jarry <rjarry@redhat.com>

Author: rjarry

api/gr_api.h

@@ -11,7 +11,7 @@
 #include <stdlib.h>
 
 // Must be bumped when making non-backward compatible changes in API headers
-#define GR_API_VERSION 2
+#define GR_API_VERSION 3
 
 // API request header.
 struct gr_api_request {

modules/infra/api/gr_infra.h

@@ -404,11 +404,17 @@ GR_REQ(GR_GRAPH_DUMP, struct gr_graph_dump_req, struct gr_graph_dump_resp);
 typedef enum : uint16_t {
 	GR_GRAPH_SET_RX_BURST = GR_BIT16(0),
 	GR_GRAPH_SET_VECTOR = GR_BIT16(1),
+	GR_GRAPH_SET_ICMP_ERROR = GR_BIT16(2),
+	GR_GRAPH_SET_ARP = GR_BIT16(3),
+	GR_GRAPH_SET_ICMP = GR_BIT16(4),
 } gr_graph_conf_set_attr_t;
 
 struct gr_graph_conf {
 	uint16_t rx_burst_max; // default 64, max 256
 	uint16_t vector_max; // default 64, max 256
+	uint16_t icmp_error_rate; // ICMP errors/sec per node per worker, 0 = no limit, default 1000
+	uint16_t arp_rate; // ARP packets/sec per worker, 0 = no limit, default 1000
+	uint16_t icmp_rate; // ICMP/ICMPv6 input packets/sec per worker, 0 = no limit, default 1000
 };
 
 GR_REQ(GR_GRAPH_CONF_GET, struct gr_empty, struct gr_graph_conf);

modules/infra/cli/graph.c

@@ -25,6 +25,21 @@ static cmd_status_t graph_conf_set(struct gr_api_client *c, const struct ec_pnod
 	else if (errno != ENOENT)
 		return CMD_ERROR;
 
+	if (arg_u16(p, "ICMP_ERROR_RATE", &req.icmp_error_rate) == 0)
+		req.set_attrs |= GR_GRAPH_SET_ICMP_ERROR;
+	else if (errno != ENOENT)
+		return CMD_ERROR;
+
+	if (arg_u16(p, "ARP_RATE", &req.arp_rate) == 0)
+		req.set_attrs |= GR_GRAPH_SET_ARP;
+	else if (errno != ENOENT)
+		return CMD_ERROR;
+
+	if (arg_u16(p, "ICMP_RATE", &req.icmp_rate) == 0)
+		req.set_attrs |= GR_GRAPH_SET_ICMP;
+	else if (errno != ENOENT)
+		return CMD_ERROR;
+
 	if (gr_api_client_send_recv(c, GR_GRAPH_CONF_SET, sizeof(req), &req, NULL) < 0)
 		return CMD_ERROR;
 
@@ -43,6 +58,9 @@ static cmd_status_t graph_conf_show(struct gr_api_client *c, const struct ec_pno
 	struct gr_object *o = gr_object_new(NULL);
 	gr_object_field(o, "vector_max", GR_DISP_INT, "%u", sizes->vector_max);
 	gr_object_field(o, "rx_burst_max", GR_DISP_INT, "%u", sizes->rx_burst_max);
+	gr_object_field(o, "icmp_error_rate", GR_DISP_INT, "%u", sizes->icmp_error_rate);
+	gr_object_field(o, "arp_rate", GR_DISP_INT, "%u", sizes->arp_rate);
+	gr_object_field(o, "icmp_rate", GR_DISP_INT, "%u", sizes->icmp_rate);
 	gr_object_free(o);
 
 	free(resp_ptr);
@@ -81,14 +99,27 @@ static int ctx_init(struct ec_node *root) {
 
 	ret = CLI_COMMAND(
 		CONF_CTX(root),
-		"set (vector-max VECTOR),(rx-burst-max BURST)",
+		"set (vector-max VECTOR),(rx-burst-max BURST),(icmp-error-rate ICMP_ERROR_RATE),"
+		"(arp-rate ARP_RATE),(icmp-rate ICMP_RATE)",
 		graph_conf_set,
-		"Configure maximum burst sizes of the packet processing graph.",
+		"Configure packet processing graph parameters.",
 		with_help(
 			"Maximum size of graph vectors.", ec_node_uint("VECTOR", 1, UINT16_MAX, 10)
 		),
 		with_help(
 			"Maximum size of RX queue burst.", ec_node_uint("BURST", 1, UINT16_MAX, 10)
+		),
+		with_help(
+			"ICMP errors/sec per node per worker (0 = no limit).",
+			ec_node_uint("ICMP_ERROR_RATE", 0, UINT16_MAX, 10)
+		),
+		with_help(
+			"ARP packets/sec per worker (0 = no limit).",
+			ec_node_uint("ARP_RATE", 0, UINT16_MAX, 10)
+		),
+		with_help(
+			"ICMP/ICMPv6 input packets/sec per worker (0 = no limit).",
+			ec_node_uint("ICMP_RATE", 0, UINT16_MAX, 10)
 		)
 	);
 	if (ret < 0)

modules/infra/control/graph.c

@@ -85,9 +85,12 @@ static struct iface_info_port *find_port(vec struct iface_info_port **ports, uin
 	return port;
 }
 
-static struct gr_graph_conf graph_conf = {
+struct gr_graph_conf graph_conf = {
 	.rx_burst_max = 64,
 	.vector_max = 64,
+	.icmp_error_rate = 1000,
+	.arp_rate = 1000,
+	.icmp_rate = 1000,
 };
 
 static int
@@ -630,6 +633,12 @@ static struct api_out graph_conf_set(const void *request, struct api_ctx *) {
 			return api_out(EOVERFLOW, 0, NULL);
 		graph_conf.vector_max = req->vector_max;
 	}
+	if (req->set_attrs & GR_GRAPH_SET_ICMP_ERROR)
+		graph_conf.icmp_error_rate = req->icmp_error_rate;
+	if (req->set_attrs & GR_GRAPH_SET_ARP)
+		graph_conf.arp_rate = req->arp_rate;
+	if (req->set_attrs & GR_GRAPH_SET_ICMP)
+		graph_conf.icmp_rate = req->icmp_rate;
 
 	if (graph_conf.rx_burst_max == prev.rx_burst_max
 	    && graph_conf.vector_max == prev.vector_max)

modules/infra/control/graph.h

@@ -37,6 +37,8 @@ rte_node_enqueue_x1(struct rte_graph *, struct rte_node *, rte_edge_t next, void
 
 rte_edge_t gr_node_attach_parent(const char *parent, const char *node);
 
+extern struct gr_graph_conf graph_conf;
+
 uint16_t drop_packets(struct rte_graph *, struct rte_node *, void **, uint16_t);
 int drop_format(char *buf, size_t buf_len, const void *data, size_t data_len);
 

modules/infra/datapath/datapath.h

@@ -3,4 +3,32 @@
 
 #pragma once
 
+#include <rte_cycles.h>
+
+#include <stdint.h>
+
 void *gr_datapath_loop(void *priv);
+
+struct rate_limit_ctx {
+	uint16_t tokens;
+	uint64_t last_refill;
+} __attribute__((packed));
+
+static inline bool
+rate_limited(struct rate_limit_ctx *ctx, const uint16_t max_rate, const uint16_t nb_pkts) {
+	uint64_t now = rte_rdtsc();
+	assert(ctx != NULL);
+
+	if (max_rate == 0)
+		return false;
+
+	if (now - ctx->last_refill >= rte_get_tsc_hz()) {
+		ctx->tokens = max_rate;
+		ctx->last_refill = now;
+	} else if (ctx->tokens == 0) {
+		return true;
+	}
+	ctx->tokens -= RTE_MIN(ctx->tokens, nb_pkts);
+
+	return false;
+}

modules/ip/datapath/arp_input.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: BSD-3-Clause
 // Copyright (c) 2024 Robin Jarry
 
+#include "datapath.h"
 #include "eth.h"
 #include "graph.h"
 #include "mbuf.h"
@@ -9,20 +10,29 @@
 #include <rte_arp.h>
 #include <rte_ether.h>
 
+GR_NODE_CTX_TYPE(arp_input_ctx, { struct rate_limit_ctx limit; });
+
 enum {
 	OP_REQUEST = 0,
 	OP_REPLY,
 	OP_UNSUPP,
 	PROTO_UNSUPP,
+	RATE_LIMITED,
 	EDGE_COUNT,
 };
 
 static uint16_t
 arp_input_process(struct rte_graph *graph, struct rte_node *node, void **objs, uint16_t nb_objs) {
+	struct arp_input_ctx *ctx = arp_input_ctx(node);
 	struct rte_arp_hdr *arp, *t;
 	struct rte_mbuf *mbuf;
 	rte_edge_t edge;
 
+	if (rate_limited(&ctx->limit, graph_conf.arp_rate, nb_objs)) {
+		rte_node_next_stream_move(graph, node, RATE_LIMITED);
+		return nb_objs;
+	}
+
 	for (uint16_t i = 0; i < nb_objs; i++) {
 		mbuf = objs[i];
 
@@ -58,6 +68,13 @@ arp_input_process(struct rte_graph *graph, struct rte_node *node, void **objs, u
 	return nb_objs;
 }
 
+static int arp_input_init(const struct rte_graph *, struct rte_node *node) {
+	struct arp_input_ctx *ctx = arp_input_ctx(node);
+	ctx->limit.tokens = graph_conf.arp_rate;
+	ctx->limit.last_refill = rte_rdtsc();
+	return 0;
+}
+
 static void arp_input_register(void) {
 	gr_eth_input_add_type(RTE_BE16(RTE_ETHER_TYPE_ARP), "arp_input");
 }
@@ -66,13 +83,15 @@ static struct rte_node_register node = {
 	.name = "arp_input",
 
 	.process = arp_input_process,
+	.init = arp_input_init,
 
 	.nb_edges = EDGE_COUNT,
 	.next_nodes = {
 		[OP_REQUEST] = "arp_input_request",
 		[OP_REPLY] = "arp_input_reply",
 		[OP_UNSUPP] = "arp_input_op_unsupp",
 		[PROTO_UNSUPP] = "arp_input_proto_unsupp",
+		[RATE_LIMITED] = "error_rate_limited",
 	},
 };
 

modules/ip/datapath/icmp_input.c

@@ -2,6 +2,7 @@
 // Copyright (c) 2024 Robin Jarry
 
 #include "control_output.h"
+#include "datapath.h"
 #include "graph.h"
 #include "ip4_datapath.h"
 #include "log.h"
@@ -12,11 +13,14 @@
 
 #include <rte_icmp.h>
 
+GR_NODE_CTX_TYPE(icmp_input_ctx, { struct rate_limit_ctx limit; });
+
 enum {
 	OUTPUT = 0,
 	CONTROL,
 	INVALID,
 	UNSUPPORTED,
+	RATE_LIMITED,
 	EDGE_COUNT,
 };
 
@@ -26,13 +30,19 @@ static control_queue_cb_t icmp_cb[UINT8_MAX];
 
 static uint16_t
 icmp_input_process(struct rte_graph *graph, struct rte_node *node, void **objs, uint16_t nb_objs) {
+	struct icmp_input_ctx *ctx = icmp_input_ctx(node);
 	struct ip_local_mbuf_data *ip_data;
 	struct rte_icmp_hdr *icmp;
 	struct rte_mbuf *mbuf;
 	rte_edge_t edge;
 	uint16_t cksum;
 	ip4_addr_t ip;
 
+	if (rate_limited(&ctx->limit, graph_conf.icmp_rate, nb_objs)) {
+		rte_node_next_stream_move(graph, node, RATE_LIMITED);
+		return nb_objs;
+	}
+
 	for (uint16_t i = 0; i < nb_objs; i++) {
 		mbuf = objs[i];
 		icmp = rte_pktmbuf_mtod(mbuf, struct rte_icmp_hdr *);
@@ -80,6 +90,13 @@ void icmp_input_register_callback(uint8_t icmp_type, control_queue_cb_t cb) {
 	icmp_cb[icmp_type] = cb;
 }
 
+static int icmp_input_init(const struct rte_graph *, struct rte_node *node) {
+	struct icmp_input_ctx *ctx = icmp_input_ctx(node);
+	ctx->limit.tokens = graph_conf.icmp_rate;
+	ctx->limit.last_refill = rte_rdtsc();
+	return 0;
+}
+
 static void icmp_input_register(void) {
 	ip_input_local_add_proto(IPPROTO_ICMP, "icmp_input");
 }
@@ -88,13 +105,15 @@ static struct rte_node_register icmp_input_node = {
 	.name = "icmp_input",
 
 	.process = icmp_input_process,
+	.init = icmp_input_init,
 
 	.nb_edges = EDGE_COUNT,
 	.next_nodes = {
 		[OUTPUT] = "icmp_output",
 		[CONTROL] = "control_output",
 		[INVALID] = "icmp_input_invalid",
 		[UNSUPPORTED] = "icmp_input_unsupported",
+		[RATE_LIMITED] = "error_rate_limited",
 	},
 };
 

modules/ip/datapath/ip_error.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: BSD-3-Clause
 // Copyright (c) 2024 Christophe Fontaine
 
+#include "datapath.h"
 #include "graph.h"
 #include "ip4.h"
 #include "ip4_datapath.h"
@@ -13,18 +14,20 @@
 GR_NODE_CTX_TYPE(ip_error_ctx, {
 	uint8_t icmp_type;
 	uint8_t icmp_code;
+	struct rate_limit_ctx limit;
 });
 
 enum edges {
 	ICMP_OUTPUT = 0,
 	NO_HEADROOM,
 	NO_IP,
+	RATE_LIMITED,
 	EDGE_COUNT,
 };
 
 static uint16_t
 ip_error_process(struct rte_graph *graph, struct rte_node *node, void **objs, uint16_t nb_objs) {
-	const struct ip_error_ctx *ctx = ip_error_ctx(node);
+	struct ip_error_ctx *ctx = ip_error_ctx(node);
 	struct ip_local_mbuf_data *ip_data;
 	const struct nexthop_info_l3 *l3;
 	const struct nexthop *nh, *local;
@@ -36,6 +39,11 @@ ip_error_process(struct rte_graph *graph, struct rte_node *node, void **objs, ui
 	rte_edge_t edge;
 	unsigned len;
 
+	if (rate_limited(&ctx->limit, graph_conf.icmp_error_rate, nb_objs)) {
+		rte_node_next_stream_move(graph, node, RATE_LIMITED);
+		return nb_objs;
+	}
+
 	for (uint16_t i = 0; i < nb_objs; i++) {
 		mbuf = objs[i];
 
@@ -100,20 +108,26 @@ static int ttl_exceeded_init(const struct rte_graph *, struct rte_node *node) {
 	struct ip_error_ctx *ctx = ip_error_ctx(node);
 	ctx->icmp_type = RTE_ICMP_TYPE_TTL_EXCEEDED;
 	ctx->icmp_code = RTE_ICMP_CODE_TTL_EXCEEDED;
+	ctx->limit.tokens = graph_conf.icmp_error_rate;
+	ctx->limit.last_refill = rte_rdtsc();
 	return 0;
 }
 
 static int no_route_init(const struct rte_graph *, struct rte_node *node) {
 	struct ip_error_ctx *ctx = ip_error_ctx(node);
 	ctx->icmp_type = RTE_ICMP_TYPE_DEST_UNREACHABLE;
 	ctx->icmp_code = RTE_ICMP_CODE_UNREACH_NET;
+	ctx->limit.tokens = graph_conf.icmp_error_rate;
+	ctx->limit.last_refill = rte_rdtsc();
 	return 0;
 }
 
 static int frag_needed_init(const struct rte_graph *, struct rte_node *node) {
 	struct ip_error_ctx *ctx = ip_error_ctx(node);
 	ctx->icmp_type = RTE_ICMP_TYPE_DEST_UNREACHABLE;
 	ctx->icmp_code = RTE_ICMP_CODE_UNREACH_FRAG;
+	ctx->limit.tokens = graph_conf.icmp_error_rate;
+	ctx->limit.last_refill = rte_rdtsc();
 	return 0;
 }
 
@@ -125,6 +139,7 @@ static struct rte_node_register ip_forward_ttl_exceeded_node = {
 		[ICMP_OUTPUT] = "icmp_output",
 		[NO_HEADROOM] = "error_no_headroom",
 		[NO_IP] = "error_no_local_ip",
+		[RATE_LIMITED] = "error_rate_limited",
 	},
 	.init = ttl_exceeded_init,
 };
@@ -137,6 +152,7 @@ static struct rte_node_register no_route_node = {
 		[ICMP_OUTPUT] = "icmp_output",
 		[NO_HEADROOM] = "error_no_headroom",
 		[NO_IP] = "error_no_local_ip",
+		[RATE_LIMITED] = "error_rate_limited",
 	},
 	.init = no_route_init,
 };
@@ -149,6 +165,7 @@ static struct rte_node_register frag_needed_node = {
 		[ICMP_OUTPUT] = "icmp_output",
 		[NO_HEADROOM] = "error_no_headroom",
 		[NO_IP] = "error_no_local_ip",
+		[RATE_LIMITED] = "error_rate_limited",
 	},
 	.init = frag_needed_init,
 };
@@ -173,3 +190,4 @@ GR_NODE_REGISTER(info_no_route);
 GR_NODE_REGISTER(info_frag_needed);
 
 GR_DROP_REGISTER(error_no_local_ip);
+GR_DROP_REGISTER(error_rate_limited);