netdev - Re: [PATCH net-next 2/3] ip: load balance tcp connections to single dst addr and port

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6807daf7d73af_3c1f7529461@willemb.c.googlers.com.notmuch>
Date: Tue, 22 Apr 2025 14:07:51 -0400
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: David Ahern <dsahern@...nel.org>, 
 Willem de Bruijn <willemdebruijn.kernel@...il.com>, 
 netdev@...r.kernel.org
Cc: davem@...emloft.net, 
 kuba@...nel.org, 
 edumazet@...gle.com, 
 pabeni@...hat.com, 
 horms@...nel.org, 
 idosch@...dia.com, 
 kuniyu@...zon.com, 
 Willem de Bruijn <willemb@...gle.com>
Subject: Re: [PATCH net-next 2/3] ip: load balance tcp connections to single
 dst addr and port

David Ahern wrote:
> On 4/20/25 12:04 PM, Willem de Bruijn wrote:
> > From: Willem de Bruijn <willemb@...gle.com>
> > 
> > Load balance new TCP connections across nexthops also when they
> > connect to the same service at a single remote address and port.
> > 
> > This affects only port-based multipath hashing:
> > fib_multipath_hash_policy 1 or 3.
> > 
> > Local connections must choose both a source address and port when
> > connecting to a remote service, in ip_route_connect. This
> > "chicken-and-egg problem" (commit 2d7192d6cbab ("ipv4: Sanitize and
> > simplify ip_route_{connect,newports}()")) is resolved by first
> > selecting a source address, by looking up a route using the zero
> > wildcard source port and address.
> > 
> > As a result multiple connections to the same destination address and
> > port have no entropy in fib_multipath_hash.
> > 
> > This is not a problem when forwarding, as skb-based hashing has a
> > 4-tuple. Nor when establishing UDP connections, as autobind there
> > selects a port before reaching ip_route_connect.
> > 
> > Load balance also TCP, by using a random port in fib_multipath_hash.
> > Port assignment in inet_hash_connect is not atomic with
> > ip_route_connect. Thus ports are unpredictable, effectively random.
> > 
> 
> can the call to inet_hash_connect be moved up? Get an actual sport
> assignment and then use it for routing lookups.

That inverts the chicken-and-egg problem and selects a source
port before a socket. That would be a significant change, and
considerably more risky.

More concrete concern is that during port selection
__inet(6)_check_established uses inet_rcv_saddr/sk_v6_rcv_saddr to
check for established sockets, so expects the saddr to already have
been chosen.

Inverting the choice requires matching against all local addresses.