On Tue, Apr 13, 2021 at 08:28:52PM -0700, David Ahern wrote:
> On 4/13/21 4:55 AM, Balaev Pavel wrote:
> > Ability for a user to assign seed value to multipath route hashes.
> > Now kernel uses random seed value to prevent hash-flooding DoS attacks;
> > however, it disables some use cases, f.e:
> >
> > +-------+ +------+ +--------+
> > | |-eth0---| FW0 |---eth0-| |
> > | | +------+ | |
> > | GW0 |ECMP ECMP| GW1 |
> > | | +------+ | |
> > | |-eth1---| FW1 |---eth1-| |
> > +-------+ +------+ +--------+
> >
> > In this use case, two ECMP routers balance traffic between
> > two firewalls. If some flow transmits a response over a different channel
> > than request,
> > such flow will be dropped, because keep-state rules are created on
> > the other firewall.
> >
> > This patch adds sysctl variable: net.ipv4.fib_multipath_hash_seed.
> > User can set the same seed value on GW0 and GW1 for traffic to be
> > mirror-balanced. By default, random value is used.
> >
> > Signed-off-by: Balaev Pavel <balae...@infotecs.ru>
> > ---
> > Documentation/networking/ip-sysctl.rst | 14 ++++
> > include/net/flow_dissector.h | 4 +
> > include/net/netns/ipv4.h | 20 +++++
> > net/core/flow_dissector.c | 9 +++
> > net/ipv4/af_inet.c | 5 ++
> > net/ipv4/route.c | 10 ++-
> > net/ipv4/sysctl_net_ipv4.c | 104 +++++++++++++++++++++++++
> > 7 files changed, 165 insertions(+), 1 deletion(-)
> >
>
> This should work the same for IPv6.
I wanted to add IPv6 support after IPv4 will be approved,
anyway no problem, will add IPv6 in next version
> And please add test cases under tools/testing/selftests/net.
This feature cannot be tested whithin one host instance, becasue the same seed
will be used by default for all netns, so results will be the same
anyway, should I use QEMU for this tests?
