netdev - Re: [PATCH RFC net-next 0/7] net/ipv6: Add support for path selection using hash of 5-tuple

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 15 Feb 2018 00:45:12 +0200
From:   Or Gerlitz <gerlitz.or@...il.com>
To:     David Ahern <dsahern@...il.com>
Cc:     Ido Schimmel <idosch@...sch.org>,
        Linux Netdev List <netdev@...r.kernel.org>,
        Roopa Prabhu <roopa@...ulusnetworks.com>,
        Nikolay Aleksandrov <nikolay@...ulusnetworks.com>,
        Ido Schimmel <idosch@...lanox.com>,
        Tom Herbert <tom@...bertland.com>
Subject: Re: [PATCH RFC net-next 0/7] net/ipv6: Add support for path selection
 using hash of 5-tuple

On Tue, Feb 13, 2018 at 5:21 PM, David Ahern <dsahern@...il.com> wrote:
> On 2/13/18 5:42 AM, Ido Schimmel wrote:
>> On Tue, Feb 13, 2018 at 01:03:14PM +0200, Or Gerlitz wrote:
>>> On Tue, Feb 13, 2018 at 2:05 AM, David Ahern <dsahern@...il.com> wrote:
>>>> Hardware supports multipath selection using the standard L4 5-tuple
>>>> instead of just L3 and the flow label. In addition, some network
>>>> operators prefer IPv6 path selection to use the 5-tuple.
>>>
>>> The HW supports using flow label and AFAIK that is the preferred approach
>>> by the community (?)
>>>
>>>> To that end, add support to IPv6 for multipath hash policy
>>>
>>> so a question comes up if/what are the disadvantaged
>>> to support 5-tuple. E.g Tom was commenting that such DPI is problematic
>>> when multiple IPv6 header extensions are used.
>
> Pros and cons to both approaches (L3 only or L4). We (Cumulus Networks)
> use L4 5-tuple hash for both IPv4 and IPv6. When I asked around various
> experts all of them gave me a puzzled look as to why I was asking the
> question. Basically, the unanimous response was of course it is an L4 hash.

how the various systems you are dealing with do with traffic that involves
ipv6 extension headers? what about environments with GRE? in ipv4 GRE
fabrics are just broken for ECMP, in ipv6 they can fly with flow label but
will crash again with L4 hash.