| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <1b0c0460-914c-ffa2-ae42-af0ea12ad596@gmail.com>
Date: Mon, 3 May 2021 20:46:18 -0600
From: David Ahern <dsahern@...il.com>
To: Ido Schimmel <idosch@...sch.org>, netdev@...r.kernel.org
Cc: davem@...emloft.net, kuba@...nel.org, petrm@...dia.com,
roopa@...dia.com, nikolay@...dia.com, ssuryaextr@...il.com,
mlxsw@...dia.com, Ido Schimmel <idosch@...dia.com>
Subject: Re: [RFC PATCH net-next 07/10] ipv6: Add custom multipath hash policy
On 5/2/21 10:22 AM, Ido Schimmel wrote:
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index 9935e18146e5..b4c65c5baf35 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -2326,6 +2326,125 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb,
> }
> }
>
> +static u32 rt6_multipath_custom_hash_outer(const struct net *net,
> + const struct sk_buff *skb,
> + bool *p_has_inner)
> +{
> + unsigned long *hash_fields = ip6_multipath_hash_fields(net);
> + struct flow_keys keys, hash_keys;
> +
> + if (!net->ipv6.sysctl.multipath_hash_fields_need_outer)
> + return 0;
> +
> + memset(&hash_keys, 0, sizeof(hash_keys));
> + skb_flow_dissect_flow_keys(skb, &keys, FLOW_DISSECTOR_F_STOP_AT_ENCAP);
> +
> + hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(SRC_IP, hash_fields))
> + hash_keys.addrs.v6addrs.src = keys.addrs.v6addrs.src;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(DST_IP, hash_fields))
> + hash_keys.addrs.v6addrs.dst = keys.addrs.v6addrs.dst;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(IP_PROTO, hash_fields))
> + hash_keys.basic.ip_proto = keys.basic.ip_proto;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(FLOWLABEL, hash_fields))
> + hash_keys.tags.flow_label = keys.tags.flow_label;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(SRC_PORT, hash_fields))
> + hash_keys.ports.src = keys.ports.src;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(DST_PORT, hash_fields))
> + hash_keys.ports.dst = keys.ports.dst;
> +
> + *p_has_inner = !!(keys.control.flags & FLOW_DIS_ENCAPSULATION);
> + return flow_hash_from_keys(&hash_keys);
> +}
> +
> +static u32 rt6_multipath_custom_hash_inner(const struct net *net,
> + const struct sk_buff *skb,
> + bool has_inner)
> +{
> + unsigned long *hash_fields = ip6_multipath_hash_fields(net);
> + struct flow_keys keys, hash_keys;
> +
> + /* We assume the packet carries an encapsulation, but if none was
> + * encountered during dissection of the outer flow, then there is no
> + * point in calling the flow dissector again.
> + */
> + if (!has_inner)
> + return 0;
> +
> + if (!net->ipv6.sysctl.multipath_hash_fields_need_inner)
> + return 0;
> +
> + memset(&hash_keys, 0, sizeof(hash_keys));
> + skb_flow_dissect_flow_keys(skb, &keys, 0);
> +
> + if (!(keys.control.flags & FLOW_DIS_ENCAPSULATION))
> + return 0;
> +
> + if (keys.control.addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) {
> + hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_SRC_IP, hash_fields))
> + hash_keys.addrs.v4addrs.src = keys.addrs.v4addrs.src;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_DST_IP, hash_fields))
> + hash_keys.addrs.v4addrs.dst = keys.addrs.v4addrs.dst;
> + } else if (keys.control.addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS) {
> + hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_SRC_IP, hash_fields))
> + hash_keys.addrs.v6addrs.src = keys.addrs.v6addrs.src;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_DST_IP, hash_fields))
> + hash_keys.addrs.v6addrs.dst = keys.addrs.v6addrs.dst;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_FLOWLABEL, hash_fields))
> + hash_keys.tags.flow_label = keys.tags.flow_label;
> + }
> +
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_IP_PROTO, hash_fields))
> + hash_keys.basic.ip_proto = keys.basic.ip_proto;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_SRC_PORT, hash_fields))
> + hash_keys.ports.src = keys.ports.src;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(INNER_DST_PORT, hash_fields))
> + hash_keys.ports.dst = keys.ports.dst;
> +
> + return flow_hash_from_keys(&hash_keys);
> +}
> +
> +static u32 rt6_multipath_custom_hash_skb(const struct net *net,
> + const struct sk_buff *skb)
> +{
> + u32 mhash, mhash_inner;
> + bool has_inner = true;
> +
> + mhash = rt6_multipath_custom_hash_outer(net, skb, &has_inner);
> + mhash_inner = rt6_multipath_custom_hash_inner(net, skb, has_inner);
> +
> + return jhash_2words(mhash, mhash_inner, 0);
> +}
> +
> +static u32 rt6_multipath_custom_hash_fl6(const struct net *net,
> + const struct flowi6 *fl6)
> +{
> + unsigned long *hash_fields = ip6_multipath_hash_fields(net);
> + struct flow_keys hash_keys;
> +
> + if (!net->ipv6.sysctl.multipath_hash_fields_need_outer)
> + return 0;
> +
> + memset(&hash_keys, 0, sizeof(hash_keys));
> + hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(SRC_IP, hash_fields))
> + hash_keys.addrs.v6addrs.src = fl6->saddr;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(DST_IP, hash_fields))
> + hash_keys.addrs.v6addrs.dst = fl6->daddr;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(IP_PROTO, hash_fields))
> + hash_keys.basic.ip_proto = fl6->flowi6_proto;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(FLOWLABEL, hash_fields))
> + hash_keys.tags.flow_label = (__force u32)flowi6_get_flowlabel(fl6);
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(SRC_PORT, hash_fields))
> + hash_keys.ports.src = fl6->fl6_sport;
> + if (FIB_MULTIPATH_HASH_TEST_FIELD(DST_PORT, hash_fields))
> + hash_keys.ports.dst = fl6->fl6_dport;
> +
> + return flow_hash_from_keys(&hash_keys);
> +}
> +
given the amount of duplication with IPv4, should be able to use inline
macros and the flowi_uli union to make some common helpers without
impacting performance.
Powered by blists - more mailing lists