netdev - [PATCH net-next v4 0/5] Make hash rethink configurable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 28 Jan 2022 22:44:03 +0300
From:   Akhmat Karakotov <hmukos@...dex-team.ru>
To:     netdev@...r.kernel.org
Cc:     davem@...emloft.net, kuba@...nel.org, edumazet@...gle.com,
        eric.dumazet@...il.com, bpf@...r.kernel.org, ast@...nel.org,
        daniel@...earbox.net, andrii@...nel.org, tom@...bertland.com,
        hmukos@...dex-team.ru, zeil@...dex-team.ru, mitradir@...dex-team.ru
Subject: [PATCH net-next v4 0/5] Make hash rethink configurable

As it was shown in the report by Alexander Azimov, hash rethink at the
client-side may lead to connection timeout toward stateful anycast
services. Tom Herbert created a patchset to address this issue by applying
hash rethink only after a negative routing event (3RTOs) [1]. This change
also affects server-side behavior, which we found undesirable. This
patchset changes defaults in a way to make them safe: hash rethink at the
client-side is disabled and enabled at the server-side upon each RTO
event or in case of duplicate acknowledgments.

This patchset provides two options to change default behaviour. The hash
rethink may be disabled at the server-side by the new sysctl option.
Changes in the sysctl option don't affect default behavior at the
client-side.

Hash rethink can also be enabled/disabled with socket option or bpf
syscalls which ovewrite both default and sysctl settings. This socket
option is available on both client and server-side. This should provide
mechanics to enable hash rethink inside administrative domain, such as DC,
where hash rethink at the client-side can be desirable.

[1] https://lore.kernel.org/netdev/20210809185314.38187-1-tom@herbertland.com/

v2:
	- Changed sysctl default to ENABLED in all patches. Reduced sysctl
	  and socket option size to u8. Fixed netns bug reported by kernel
	  test robot.

v3:
	- Fixed bug with bad u8 comparison. Moved sk->txrehash to use less
	  bytes in struct. Added WRITE_ONCE() in setsockopt in and
	  READ_ONCE() in tcp_rtx_synack.

v4:
	- Rebase and add documentation for sysctl option.

Akhmat Karakotov (5):
  txhash: Make rethinking txhash behavior configurable via sysctl
  txhash: Add socket option to control TX hash rethink behavior
  txhash: Add txrehash sysctl description
  bpf: Add SO_TXREHASH setsockopt
  tcp: Change SYN ACK retransmit behaviour to account for rehash

 Documentation/admin-guide/sysctl/net.rst |  9 ++++++++
 arch/alpha/include/uapi/asm/socket.h     |  2 ++
 arch/mips/include/uapi/asm/socket.h      |  2 ++
 arch/parisc/include/uapi/asm/socket.h    |  2 ++
 arch/sparc/include/uapi/asm/socket.h     |  2 ++
 include/net/netns/core.h                 |  1 +
 include/net/sock.h                       | 28 +++++++++++++-----------
 include/uapi/asm-generic/socket.h        |  2 ++
 include/uapi/linux/socket.h              |  4 ++++
 net/core/filter.c                        | 10 +++++++++
 net/core/net_namespace.c                 |  2 ++
 net/core/sock.c                          | 14 ++++++++++++
 net/core/sysctl_net_core.c               | 14 ++++++++++--
 net/ipv4/inet_connection_sock.c          |  3 +++
 net/ipv4/tcp_output.c                    |  4 +++-
 15 files changed, 83 insertions(+), 16 deletions(-)

-- 
2.17.1