netdev - Re: [PATCH 2/2] ipv6: Set flow label to skb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 28 Apr 2014 22:49:02 +0200
From:	Florent Fourcot <florent.fourcot@...t-bretagne.fr>
To:	Tom Herbert <therbert@...gle.com>
CC:	Linux Netdev List <netdev@...r.kernel.org>
Subject: Re: [PATCH 2/2] ipv6: Set flow label to skb_hash on transmit


> If someone is implementing a strong policy for
> flow labels (like dropping based on it), it would be incorrect.
> RFC6437 is clear on this:
> 

And correct for RFC 3697:

>    A source node MUST ensure that it does not unintentionally reuse Flow
>    Label values it is currently using or has recently used when creating
>    new flows.

The situation is very uncomfortable, but the choice is to break old
implementations based on a rule valid between (at least) 2004 and 2011,
or to follow the newer RFC. If we not set it by default, the
distributions still have the choice to enable it.


>> As second point, the name of auto_flowlabel is in my opinion not a
>> perfect choice if you set a label it only on tunnels. This is exactly
>> the same name that a BSD sysctl, setting a random label on all sockets
>> (TCP, UDP...). The flow label world is already hard enough to
>> understand, thanks to various implementations.
>>
> This is not just for tunnels, but would apply to transports and
> potentially obviates the need for a lot of UDP encapsulation (like
> ESP/UDP). So it would appear that this is pretty much the same thing
> as what the BSD implementation does and same sysctl name (a happy
> coincidence). Looks like the default in BSD is on btw.
> 

Oups sorry, I missed the line in the patch for the transports. If you
follow the BSD implementation, what about the IPV6_AUTOFLOWLABEL socket
option, to disable/enable it only on some sockets? (the enable is
actually already available thanks to the manager).
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html