netdev - Re: [net-next v3] ipv6: sr: Compute flowlabel for outer IPv6 header of seg6 encap mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180425.130304.1605881647944477071.davem@davemloft.net>
Date:   Wed, 25 Apr 2018 13:03:04 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     amsalam20@...il.com
Cc:     dav.lebrun@...il.com, kuznet@....inr.ac.ru,
        yoshfuji@...ux-ipv6.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [net-next v3] ipv6: sr: Compute flowlabel for outer IPv6
 header of seg6 encap mode

From: Ahmed Abdelsalam <amsalam20@...il.com>
Date: Tue, 24 Apr 2018 20:23:16 +0200

> ECMP (equal-cost multipath) hashes are typically computed on the packets'
> 5-tuple(src IP, dst IP, src port, dst port, L4 proto).
> 
> For encapsulated packets, the L4 data is not readily available and ECMP
> hashing will often revert to (src IP, dst IP). This will lead to traffic
> polarization on a single ECMP path, causing congestion and waste of network
> capacity.
> 
> In IPv6, the 20-bit flow label field is also used as part of the ECMP hash.
> In the lack of L4 data, the hashing will be on (src IP, dst IP, flow
> label). Having a non-zero flow label is thus important for proper traffic
> load balancing when L4 data is unavailable (i.e., when packets are
> encapsulated).
> 
> Currently, the seg6_do_srh_encap() function extracts the original packet's
> flow label and set it as the outer IPv6 flow label. There are two issues
> with this behaviour:
> 
> a) There is no guarantee that the inner flow label is set by the source.
> b) If the original packet is not IPv6, the flow label will be set to
> zero (e.g., IPv4 or L2 encap).
> 
> This patch adds a function, named seg6_make_flowlabel(), that computes a
> flow label from a given skb. It supports IPv6, IPv4 and L2 payloads, and
> leverages the per namespace 'seg6_flowlabel" sysctl value.
> 
> The currently support behaviours are as follows:
> -1 set flowlabel to zero.
> 0 copy flowlabel from Inner paceket in case of Inner IPv6
> (Set flowlabel to 0 in case IPv4/L2)
> 1 Compute the flowlabel using seg6_make_flowlabel()
> 
> This patch has been tested for IPv6, IPv4, and L2 traffic.
> 
> Signed-off-by: Ahmed Abdelsalam <amsalam20@...il.com>

Applied.

Please submit a patch which adds appropriate documentation for this new sysctl
to Documentation/networking/ip-sysctl.txt

Thank you.