netdev - Re: [PATCH v3 net-next] net: multipath routing: configurable seed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 13 Apr 2021 20:28:52 -0700
From:   David Ahern <dsahern@...il.com>
To:     Balaev Pavel <balaevpa@...otecs.ru>, netdev@...r.kernel.org
Cc:     christophe.jaillet@...adoo.fr, davem@...emloft.net,
        kuba@...nel.org, yoshfuji@...ux-ipv6.org, dsahern@...nel.org
Subject: Re: [PATCH v3 net-next] net: multipath routing: configurable seed

On 4/13/21 4:55 AM, Balaev Pavel wrote:
> Ability for a user to assign seed value to multipath route hashes.
> Now kernel uses random seed value to prevent hash-flooding DoS attacks;
> however, it disables some use cases, f.e:
> 
> +-------+        +------+        +--------+
> |       |-eth0---| FW0  |---eth0-|        |
> |       |        +------+        |        |
> |  GW0  |ECMP                ECMP|  GW1   |
> |       |        +------+        |        |
> |       |-eth1---| FW1  |---eth1-|        |
> +-------+        +------+        +--------+
> 
> In this use case, two ECMP routers balance traffic between
> two firewalls. If some flow transmits a response over a different channel than request,
> such flow will be dropped, because keep-state rules are created on
> the other firewall.
> 
> This patch adds sysctl variable: net.ipv4.fib_multipath_hash_seed.
> User can set the same seed value on GW0 and GW1 for traffic to be
> mirror-balanced. By default, random value is used.
> 
> Signed-off-by: Balaev Pavel <balaevpa@...otecs.ru>
> ---
>  Documentation/networking/ip-sysctl.rst |  14 ++++
>  include/net/flow_dissector.h           |   4 +
>  include/net/netns/ipv4.h               |  20 +++++
>  net/core/flow_dissector.c              |   9 +++
>  net/ipv4/af_inet.c                     |   5 ++
>  net/ipv4/route.c                       |  10 ++-
>  net/ipv4/sysctl_net_ipv4.c             | 104 +++++++++++++++++++++++++
>  7 files changed, 165 insertions(+), 1 deletion(-)
> 

This should work the same for IPv6.

And please add test cases under tools/testing/selftests/net.