netdev - Re: ipv6: multipatth routing (ecmp) does not work for local outgoing connects

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2f97f280-0fb7-023e-a0c3-eb3805f04835@gmail.com>
Date:   Mon, 3 Dec 2018 09:28:24 -0700
From:   David Ahern <dsahern@...il.com>
To:     Lars Ekman G <lars.g.ekman@....tech>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: ipv6: multipatth routing (ecmp) does not work for local outgoing
 connects

On 12/3/18 2:32 AM, Lars Ekman G wrote:
> 
> Hi,
> 
> Kernel version; 4.19.3
> 
> A multipath ipv6 route is setup;
> 
> # ip -6 ro
> 1000:: proto zebra metric 20 
>         nexthop via 1000::1:c0a8:101 dev eth1 weight 1 
>         nexthop via 1000::1:c0a8:104 dev eth1 weight 1 
>         nexthop via 1000::1:c0a8:102 dev eth1 weight 1 
>         nexthop via 1000::1:c0a8:103 dev eth1 weight 1 pref medium
> ...
> 
> When traffic is forwarded through this node it is distributed among the
> targets, but if the connections originates from the local node just
> one target is selected.

...

> 
> I have searched the netdev archive but did not found
> anything relevant.

It's a known problem. The route lookup happens before the local port and
address are assigned to the socket and the resulting lookup is cached on
the socket. The missing port and address reduce the entropy for
distributing the lookup across paths. You can see that with 'perf record
-e fib6:* -a' followed by 'perf script'.