netdev - Re: [PATCH net-next 0/5] Route ICMPv6 errors with the flow when ECMP in use

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b68ce770-4035-e2db-3df2-4cbe83cc20be@stressinduktion.org>
Date:   Thu, 27 Oct 2016 23:54:49 +0200
From:   Hannes Frederic Sowa <hannes@...essinduktion.org>
To:     David Miller <davem@...emloft.net>, jkbs@...hat.com
Cc:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net-next 0/5] Route ICMPv6 errors with the flow when ECMP
 in use

Hi,

On 27.10.2016 17:23, David Miller wrote:
> From: Jakub Sitnicki <jkbs@...hat.com>
> Date: Mon, 24 Oct 2016 11:28:47 +0200
> 
>> However, for it to work IPv6 flow labels have to be same in both
>> directions (i.e. reflected) or need to be chosen in a manner that
>> ensures that the flow going in the opposite direction would actually
>> be routed to a given path.
> 
> My understanding is that this is not really guaranteed, and that
> entities are nearly encouraged to set the flow label in whatever
> manner makes sense for their use case.

In general this is true.

> I think we really cannot have any kind of hard dependency on how
> flow labels are set and used by the internet.

Probably/Hopefully ECMP setups are set up by the same entity that also
operates the servers, thus they can easily control the reflection of
flow labels on those servers. This might be especially important for
anycast services hosted behind ECMP services.

If the flow labels don't match, these patches are just best effort and
don't improve nor worsen the situation (lot's of traffic afaik still
carries 0 as flow label which indeed does help).

Bye,
Hannes