Re: [v6ops] Flow label setting [WG Doc? draft-gont-v6ops-ipv6-ehs-packet-drops]

[Brian E Carpenter <[e-mail]>]

Warren,

A 20-bit hash of the evil bit?

Regards
   Brian

On 15/03/2016 19:36, Warren Kumari wrote:
> On Tue, Mar 15, 2016 at 11:09 AM Brian E Carpenter <
> [e-mail]> wrote:
> 
>> On 15/03/2016 11:32, Tom Herbert wrote:
>>
>> ...
>>> - Linux (e.g. Android will): sets the flow label for new connections
>>> (TCP or connected UDP socket) using prandom_u32 (pseudo random
>>> number). The flow label for a connection may change if the connection
>>> is failing in hopes of finding a better route
>>
>> In that case, it really doesn't matter as far as ECMP or load balancing
>> goes
>> if the flow label changes, since the path will be changing anyway.
>> (OK, it might matter for server load balancing at the destination,
>> but that is a corner case that has to be dealt with regardless.)
>>
>>> -- either the networking
>>> stack detects a bad route (i.e. TCP is retransmitting) or userspace
>>> can request a route change if it has information about path quality.
>>> So flow labels are not necessarily persistent which probably makes
>>> flow label filtering a bad idea
>>
>> It's a bad idea, period. If you are trying to detect malicious traffic
>> you will need DPI anyway.
>>
> 
> ... but, but, what if you are trying to use this to permit *good* traffic?!
> 
> You just *know* that if you provide the ability to filter on flow labels
> that some silly monkey will invent some horrendous hack where you have to
> portknock on the SSH port with the flowlabel set to 0xBAA. Or "firewall"
> their corporate network to only allow flowlables of 0x123 (and provide a
> client that sets the flowlabel on all packets sent to that network to
> 0x123).
> 
> Oh! Huh! Nftable provides the "ipv6 flowlabel" matching primitive.
> And I can just stuff (0xBAA & IPV6_FLOWINFO_FLOWLABEL) into flr_label...
> 
> Oh no... I'm the stupid monkey here...
> 
> :-P
> 
> W
> 
>>
>>> at least if persistence for the
>>> lifetime of a connection is required for that (see
>>> http://www.maths.tcd.ie/~dwmalone/p/ec2nd05.pdf). For cases with no
>>> connection state (unconnected UDP, forward and encapsulate), the flow
>>> label is generated by parsing the packet to determine a hash based on
>>> L3/L4 information.
>>>
>>> - Windows: I believe you mentioned that Windows 7 doesn't seem to have
>>> support for setting flow labels.
>>
>> I couldn't find anything. Presumably it can be done by apps through the
>> Winsock API, but that isn't very useful.
>>
>>> Maybe someone from Microsoft can
>>> clarify this and let us know what the prospects are for getting flow
>>> label support.
>>
>> Please.
>>    Brian
>>
>> _______________________________________________
>> v6ops mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/v6ops
>>
>