On 4/13/21 4:55 AM, Balaev Pavel wrote: > Ability for a user to assign seed value to multipath route hashes. > Now kernel uses random seed value to prevent hash-flooding DoS attacks; > however, it disables some use cases, f.e: > > +-------+ +------+ +--------+ > | |-eth0---| FW0 |---eth0-| | > | | +------+ | | > | GW0 |ECMP ECMP| GW1 | > | | +------+ | | > | |-eth1---| FW1 |---eth1-| | > +-------+ +------+ +--------+ > > In this use case, two ECMP routers balance traffic between > two firewalls. If some flow transmits a response over a different channel > than request, > such flow will be dropped, because keep-state rules are created on > the other firewall. > > This patch adds sysctl variable: net.ipv4.fib_multipath_hash_seed. > User can set the same seed value on GW0 and GW1 for traffic to be > mirror-balanced. By default, random value is used. > > Signed-off-by: Balaev Pavel <balae...@infotecs.ru> > --- > Documentation/networking/ip-sysctl.rst | 14 ++++ > include/net/flow_dissector.h | 4 + > include/net/netns/ipv4.h | 20 +++++ > net/core/flow_dissector.c | 9 +++ > net/ipv4/af_inet.c | 5 ++ > net/ipv4/route.c | 10 ++- > net/ipv4/sysctl_net_ipv4.c | 104 +++++++++++++++++++++++++ > 7 files changed, 165 insertions(+), 1 deletion(-) >
This should work the same for IPv6. And please add test cases under tools/testing/selftests/net.
