netdev - Re: [PATCH net-next 5/5] ipv6: Compute multipath hash for forwarded ICMP errors from offending packet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 31 Oct 2016 15:15:34 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     jkbs@...hat.com
Cc:     tom@...bertland.com, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, kuznet@....inr.ac.ru,
        jmorris@...ei.org, yoshfuji@...ux-ipv6.org, kaber@...sh.net
Subject: Re: [PATCH net-next 5/5] ipv6: Compute multipath hash for
 forwarded ICMP errors from offending packet

From: Jakub Sitnicki <jkbs@...hat.com>
Date: Sun, 30 Oct 2016 14:03:11 +0100

> 2) ensure the flow labels used in both directions are the same (either
>    reflected by one side, or fixed, e.g. not used and set to 0), so that
>    the 4-tuple we hash over when forwarding, <src addr, dst addr, flow
>    label, next hdr>, is the same both ways, modulo the order of
>    addresses.

Even Linux, by default, does not do reflection.

See the flowlabel_consistency sysctl, which we set by default to '1'.

I think we need to think a lot more about how systems actually set and
use flowlabels.

Also, one issue I also had with this series was adding a new member
to the flow label.  Is it possible to implement this like the ipv4
side did, by simply passing a new parameter around to the necessary
functions?

Thanks.