netdev - Flow label persistence

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 19 Nov 2020 08:49:21 -0700
From:   Tom Herbert <tom@...bertland.com>
To:     Linux Kernel Network Developers <netdev@...r.kernel.org>
Subject: Flow label persistence

HI,

A potential issue came up on v6ops list in IETF that Linux stack
changes the flow label for a connection at every RTO, this is the
feature where we change the txhash on a failing connection to try to
find a route (the flow label is derived from the txhash). The problem
with changing the flow label for a connection is that it may cause
problems when stateful middleboxes are in the path, for instance if a
flow label change causes packets for a connection to take a different
route they might be forwarded to a different stateful firewall that
didn't see the 3WHS so don't have any flow state and hence drop the
packets.

I was under the assumption that we had a sysctl that would enable
changing the txhash for a connection and the default was off so that
flow labels would be persistent for the life of the connection.
Looking at the code now, I don't see that safety net, it looks like
the defauly behavior allows changing the hash. Am I missing something?

Thanks,
Tom