netdev - Re: [PATCH RFC net-next 0/7] net/ipv6: Add support for path selection using hash of 5-tuple

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 13 Feb 2018 08:21:14 -0700
From:   David Ahern <dsahern@...il.com>
To:     Ido Schimmel <idosch@...sch.org>, Or Gerlitz <gerlitz.or@...il.com>
Cc:     Linux Netdev List <netdev@...r.kernel.org>,
        Roopa Prabhu <roopa@...ulusnetworks.com>,
        Nikolay Aleksandrov <nikolay@...ulusnetworks.com>,
        Ido Schimmel <idosch@...lanox.com>,
        Tom Herbert <tom@...bertland.com>
Subject: Re: [PATCH RFC net-next 0/7] net/ipv6: Add support for path selection
 using hash of 5-tuple

On 2/13/18 5:42 AM, Ido Schimmel wrote:
> On Tue, Feb 13, 2018 at 01:03:14PM +0200, Or Gerlitz wrote:
>> On Tue, Feb 13, 2018 at 2:05 AM, David Ahern <dsahern@...il.com> wrote:
>>> Hardware supports multipath selection using the standard L4 5-tuple
>>> instead of just L3 and the flow label. In addition, some network
>>> operators prefer IPv6 path selection to use the 5-tuple.
>>
>> The HW supports using flow label and AFAIK that is the preferred approach
>> by the community (?)
>>
>>> To that end, add support to IPv6 for multipath hash policy
>>
>> so a question comes up if/what are the disadvantaged
>> to support 5-tuple. E.g Tom was commenting that such DPI is problematic
>> when multiple IPv6 header extensions are used.

Pros and cons to both approaches (L3 only or L4). We (Cumulus Networks)
use L4 5-tuple hash for both IPv4 and IPv6. When I asked around various
experts all of them gave me a puzzled look as to why I was asking the
question. Basically, the unanimous response was of course it is an L4 hash.


> 
> Tom is much more qualified to answer this, but I think the problem is
> that the flow label isn't always set. Also, apparently some devices
> change the flow label mid flow. See:
> 
> "At Fastly, this hashing is performed by an Ethernet switch ASIC, and to
> avoid breakage, the IPv6 hashing function must not include the flow
> label. As in IPv4, the hash function includes the source and destination
> information in the L3 and L4 headers."
> https://blog.apnic.net/2018/01/11/ipv6-flow-label-misuse-hashing/
> https://www.youtube.com/watch?v=b0CRjOpnT7w
> https://pc.nanog.org/static/published/meetings/NANOG71/1531/20171003_Jaeggli_Lightning_Talk_Ipv6_v1.pdf
>