netdev - Re: [PATCH RFC net-next 0/7] net/ipv6: Add support for path selection using hash of 5-tuple

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 13 Feb 2018 14:42:05 +0200
From:   Ido Schimmel <idosch@...sch.org>
To:     Or Gerlitz <gerlitz.or@...il.com>
Cc:     David Ahern <dsahern@...il.com>,
        Linux Netdev List <netdev@...r.kernel.org>,
        Roopa Prabhu <roopa@...ulusnetworks.com>,
        Nikolay Aleksandrov <nikolay@...ulusnetworks.com>,
        Ido Schimmel <idosch@...lanox.com>,
        Tom Herbert <tom@...bertland.com>
Subject: Re: [PATCH RFC net-next 0/7] net/ipv6: Add support for path
 selection using hash of 5-tuple

On Tue, Feb 13, 2018 at 01:03:14PM +0200, Or Gerlitz wrote:
> On Tue, Feb 13, 2018 at 2:05 AM, David Ahern <dsahern@...il.com> wrote:
> > Hardware supports multipath selection using the standard L4 5-tuple
> > instead of just L3 and the flow label. In addition, some network
> > operators prefer IPv6 path selection to use the 5-tuple.
> 
> The HW supports using flow label and AFAIK that is the preferred approach
> by the community (?)
> 
> > To that end, add support to IPv6 for multipath hash policy
> 
> so a question comes up if/what are the disadvantaged
> to support 5-tuple. E.g Tom was commenting that such DPI is problematic
> when multiple IPv6 header extensions are used.

Tom is much more qualified to answer this, but I think the problem is
that the flow label isn't always set. Also, apparently some devices
change the flow label mid flow. See:

"At Fastly, this hashing is performed by an Ethernet switch ASIC, and to
avoid breakage, the IPv6 hashing function must not include the flow
label. As in IPv4, the hash function includes the source and destination
information in the L3 and L4 headers."
https://blog.apnic.net/2018/01/11/ipv6-flow-label-misuse-hashing/
https://www.youtube.com/watch?v=b0CRjOpnT7w
https://pc.nanog.org/static/published/meetings/NANOG71/1531/20171003_Jaeggli_Lightning_Talk_Ipv6_v1.pdf