linux-kernel - Re: [net-next v3] ipv6: sr: Compute flowlabel for outer IPv6 header of seg6 encap mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20180426102306.5febbb0b545be315a784dd75@gmail.com>
Date:   Thu, 26 Apr 2018 10:23:06 +0200
From:   Ahmed Abdelsalam <amsalam20@...il.com>
To:     David Miller <davem@...emloft.net>
Cc:     dav.lebrun@...il.com, kuznet@....inr.ac.ru,
        yoshfuji@...ux-ipv6.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [net-next v3] ipv6: sr: Compute flowlabel for outer IPv6 header
 of seg6 encap mode

On Wed, 25 Apr 2018 13:03:04 -0400 (EDT)
David Miller <davem@...emloft.net> wrote:

> From: Ahmed Abdelsalam <amsalam20@...il.com>
> Date: Tue, 24 Apr 2018 20:23:16 +0200
> 
> > ECMP (equal-cost multipath) hashes are typically computed on the packets'
> > 5-tuple(src IP, dst IP, src port, dst port, L4 proto).
> > 
> > For encapsulated packets, the L4 data is not readily available and ECMP
> > hashing will often revert to (src IP, dst IP). This will lead to traffic
> > polarization on a single ECMP path, causing congestion and waste of network
> > capacity.
> > 
> > In IPv6, the 20-bit flow label field is also used as part of the ECMP hash.
> > In the lack of L4 data, the hashing will be on (src IP, dst IP, flow
> > label). Having a non-zero flow label is thus important for proper traffic
> > load balancing when L4 data is unavailable (i.e., when packets are
> > encapsulated).
> > 
> > Currently, the seg6_do_srh_encap() function extracts the original packet's
> > flow label and set it as the outer IPv6 flow label. There are two issues
> > with this behaviour:
> > 
> > a) There is no guarantee that the inner flow label is set by the source.
> > b) If the original packet is not IPv6, the flow label will be set to
> > zero (e.g., IPv4 or L2 encap).
> > 
> > This patch adds a function, named seg6_make_flowlabel(), that computes a
> > flow label from a given skb. It supports IPv6, IPv4 and L2 payloads, and
> > leverages the per namespace 'seg6_flowlabel" sysctl value.
> > 
> > The currently support behaviours are as follows:
> > -1 set flowlabel to zero.
> > 0 copy flowlabel from Inner paceket in case of Inner IPv6
> > (Set flowlabel to 0 in case IPv4/L2)
> > 1 Compute the flowlabel using seg6_make_flowlabel()
> > 
> > This patch has been tested for IPv6, IPv4, and L2 traffic.
> > 
> > Signed-off-by: Ahmed Abdelsalam <amsalam20@...il.com>
> 
> Applied.
> 
> Please submit a patch which adds appropriate documentation for this new sysctl
> to Documentation/networking/ip-sysctl.txt

Thanks David
I will send you a patch for ip-sysctl.txt

-- 
Ahmed Abdelsalam <amsalam20@...il.com>