netdev - Re: [RFC PATCH net-next 07/10] ipv6: Add custom multipath hash policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Wed, 5 May 2021 11:50:31 +0300
From:   Ido Schimmel <idosch@...sch.org>
To:     David Ahern <dsahern@...il.com>
Cc:     netdev@...r.kernel.org, davem@...emloft.net, kuba@...nel.org,
        petrm@...dia.com, roopa@...dia.com, nikolay@...dia.com,
        ssuryaextr@...il.com, mlxsw@...dia.com,
        Ido Schimmel <idosch@...dia.com>
Subject: Re: [RFC PATCH net-next 07/10] ipv6: Add custom multipath hash policy

On Mon, May 03, 2021 at 08:46:18PM -0600, David Ahern wrote:
> On 5/2/21 10:22 AM, Ido Schimmel wrote:
> > diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> > index 9935e18146e5..b4c65c5baf35 100644
> > --- a/net/ipv6/route.c
> > +++ b/net/ipv6/route.c
> > @@ -2326,6 +2326,125 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb,
> >  	}
> >  }
> >  
> > +static u32 rt6_multipath_custom_hash_outer(const struct net *net,
> > +					   const struct sk_buff *skb,
> > +					   bool *p_has_inner)
> > +{
> > +	unsigned long *hash_fields = ip6_multipath_hash_fields(net);
> > +	struct flow_keys keys, hash_keys;
> > +
> > +	if (!net->ipv6.sysctl.multipath_hash_fields_need_outer)
> > +		return 0;
> > +
> > +	memset(&hash_keys, 0, sizeof(hash_keys));
> > +	skb_flow_dissect_flow_keys(skb, &keys, FLOW_DISSECTOR_F_STOP_AT_ENCAP);
> > +
> > +	hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(SRC_IP, hash_fields))
> > +		hash_keys.addrs.v6addrs.src = keys.addrs.v6addrs.src;
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(DST_IP, hash_fields))
> > +		hash_keys.addrs.v6addrs.dst = keys.addrs.v6addrs.dst;
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(IP_PROTO, hash_fields))
> > +		hash_keys.basic.ip_proto = keys.basic.ip_proto;
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(FLOWLABEL, hash_fields))
> > +		hash_keys.tags.flow_label = keys.tags.flow_label;
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(SRC_PORT, hash_fields))
> > +		hash_keys.ports.src = keys.ports.src;
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(DST_PORT, hash_fields))
> > +		hash_keys.ports.dst = keys.ports.dst;
> > +
> > +	*p_has_inner = !!(keys.control.flags & FLOW_DIS_ENCAPSULATION);
> > +	return flow_hash_from_keys(&hash_keys);
> > +}
> > +
> > +static u32 rt6_multipath_custom_hash_inner(const struct net *net,
> > +					   const struct sk_buff *skb,
> > +					   bool has_inner)
> > +{
> > +	unsigned long *hash_fields = ip6_multipath_hash_fields(net);
> > +	struct flow_keys keys, hash_keys;
> > +
> > +	/* We assume the packet carries an encapsulation, but if none was
> > +	 * encountered during dissection of the outer flow, then there is no
> > +	 * point in calling the flow dissector again.
> > +	 */
> > +	if (!has_inner)
> > +		return 0;
> > +
> > +	if (!net->ipv6.sysctl.multipath_hash_fields_need_inner)
> > +		return 0;
> > +
> > +	memset(&hash_keys, 0, sizeof(hash_keys));
> > +	skb_flow_dissect_flow_keys(skb, &keys, 0);
> > +
> > +	if (!(keys.control.flags & FLOW_DIS_ENCAPSULATION))
> > +		return 0;
> > +
> > +	if (keys.control.addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) {
> > +		hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
> > +		if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_SRC_IP, hash_fields))
> > +			hash_keys.addrs.v4addrs.src = keys.addrs.v4addrs.src;
> > +		if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_DST_IP, hash_fields))
> > +			hash_keys.addrs.v4addrs.dst = keys.addrs.v4addrs.dst;
> > +	} else if (keys.control.addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS) {
> > +		hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
> > +		if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_SRC_IP, hash_fields))
> > +			hash_keys.addrs.v6addrs.src = keys.addrs.v6addrs.src;
> > +		if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_DST_IP, hash_fields))
> > +			hash_keys.addrs.v6addrs.dst = keys.addrs.v6addrs.dst;
> > +		if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_FLOWLABEL, hash_fields))
> > +			hash_keys.tags.flow_label = keys.tags.flow_label;
> > +	}
> > +
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_IP_PROTO, hash_fields))
> > +		hash_keys.basic.ip_proto = keys.basic.ip_proto;
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_SRC_PORT, hash_fields))
> > +		hash_keys.ports.src = keys.ports.src;
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_DST_PORT, hash_fields))
> > +		hash_keys.ports.dst = keys.ports.dst;
> > +
> > +	return flow_hash_from_keys(&hash_keys);
> > +}
> > +
> > +static u32 rt6_multipath_custom_hash_skb(const struct net *net,
> > +					 const struct sk_buff *skb)
> > +{
> > +	u32 mhash, mhash_inner;
> > +	bool has_inner = true;
> > +
> > +	mhash = rt6_multipath_custom_hash_outer(net, skb, &has_inner);
> > +	mhash_inner = rt6_multipath_custom_hash_inner(net, skb, has_inner);
> > +
> > +	return jhash_2words(mhash, mhash_inner, 0);
> > +}
> > +
> > +static u32 rt6_multipath_custom_hash_fl6(const struct net *net,
> > +					 const struct flowi6 *fl6)
> > +{
> > +	unsigned long *hash_fields = ip6_multipath_hash_fields(net);
> > +	struct flow_keys hash_keys;
> > +
> > +	if (!net->ipv6.sysctl.multipath_hash_fields_need_outer)
> > +		return 0;
> > +
> > +	memset(&hash_keys, 0, sizeof(hash_keys));
> > +	hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(SRC_IP, hash_fields))
> > +		hash_keys.addrs.v6addrs.src = fl6->saddr;
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(DST_IP, hash_fields))
> > +		hash_keys.addrs.v6addrs.dst = fl6->daddr;
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(IP_PROTO, hash_fields))
> > +		hash_keys.basic.ip_proto = fl6->flowi6_proto;
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(FLOWLABEL, hash_fields))
> > +		hash_keys.tags.flow_label = (__force u32)flowi6_get_flowlabel(fl6);
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(SRC_PORT, hash_fields))
> > +		hash_keys.ports.src = fl6->fl6_sport;
> > +	if (FIB_MULTIPATH_HASH_TEST_FIELD(DST_PORT, hash_fields))
> > +		hash_keys.ports.dst = fl6->fl6_dport;
> > +
> > +	return flow_hash_from_keys(&hash_keys);
> > +}
> > +
> 
> given the amount of duplication with IPv4, should be able to use inline
> macros and the flowi_uli union to make some common helpers without
> impacting performance.

OK, will try to create some common helpers