netdev - Re: [PATCH net-next 4/4] net: skbuff: fix l4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 23 May 2023 17:25:54 +0200
From: Antoine Tenart <atenart@...nel.org>
To: Dumitru Ceara <dceara@...hat.com>, Eric Dumazet <edumazet@...gle.com>, Ilya Maximets <i.maximets@....org>
Cc: i.maximets@....org, davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com, netdev@...r.kernel.org
Subject: Re: [PATCH net-next 4/4] net: skbuff: fix l4_hash comment

Quoting Ilya Maximets (2023-05-18 01:00:40)
> On 5/17/23 14:05, Antoine Tenart wrote:
> > 
> > Even l4_hash w/o taking the rnd case into account does not guarantee a
> > stable hash for the lifetime of a flow; what happens if packets from the
> > same flow are received on two NICs using different keys and/or algs?
> 
> Following the same logic we can't really say that it "provides a uniform
> distribution over L4 flows" either.  The fact that L4 fields were used
> to calculate the hash, doesn't mean the hash function is any good.

Well drivers need to either trust the h/w in some ways or not use what
is provided if it's broken; or we can't be sure of anything. It's not
the same as an example where a valid setup can't guarantee a property by
design.

> > Now, I'll let some time to give a chance for others to chime in.
> 
> Sure.

I don't think we'll get more guidance and we failed to come to an
agreement so let's keep this as-is for now; I'll send a v2 w/o this
documentation change.

As for a way forward and the stability need, IMHO the hash needs to be
computed where it is used (with potential cache, not reusing skb->hash)
but if you feel this should be addressed at this level a patch doing so
might at least get others to comment (both ways).

Thanks,
Antoine