linux-kernel - ECMP is not flow-based for forwarded traffic >5.4.x

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 29 Apr 2020 07:35:57 +0000
From:   Lars Ekman G <lars.g.ekman@....tech>
To:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: ECMP is not flow-based for forwarded traffic >5.4.x

Hi,

>From somewhere between 5.4.35 and 5.5.7 flow-based ECMP for forwarded traffic has stopped working.
The fault is still present in 5.6.4 and t is present both for ipv4 and ipv6.

Ecmp is setup with (or corresponding ipv6);

        ip route add 10.0.0.0/24 \
                nexthop via 192.168.1.1 \
                nexthop via 192.168.1.2 \
                nexthop via 192.168.1.3 \
                nexthop via 192.168.1.4

Packets are routed flow-based from the machine where this route is set (local works), but traffic forwarded through this
machine is distributed packet-based. This is used as a primitive load-balancer and TCP connections fails.

Forwarded traffic is distributed flow-based in 5.4.35 and everything works. I might have missed some new config
setting in 5.5.x. Sysctls;

# cat /proc/sys/net/ipv4/fib_multipath_hash_policy
1
# cat /proc/sys/net/ipv6/fib_multipath_hash_policy
0

Best Regards,
Lars Ekman