Re: [v6ops] Flow label setting [WG Doc? draft-gont-v6ops-ipv6-ehs-packet-drops]

[Warren Kumari <[e-mail]>]

On Tue, Mar 15, 2016 at 11:09 AM Brian E Carpenter <
[e-mail]> wrote:

> On 15/03/2016 11:32, Tom Herbert wrote:
>
> ...
> > - Linux (e.g. Android will): sets the flow label for new connections
> > (TCP or connected UDP socket) using prandom_u32 (pseudo random
> > number). The flow label for a connection may change if the connection
> > is failing in hopes of finding a better route
>
> In that case, it really doesn't matter as far as ECMP or load balancing
> goes
> if the flow label changes, since the path will be changing anyway.
> (OK, it might matter for server load balancing at the destination,
> but that is a corner case that has to be dealt with regardless.)
>
> > -- either the networking
> > stack detects a bad route (i.e. TCP is retransmitting) or userspace
> > can request a route change if it has information about path quality.
> > So flow labels are not necessarily persistent which probably makes
> > flow label filtering a bad idea
>
> It's a bad idea, period. If you are trying to detect malicious traffic
> you will need DPI anyway.
>

... but, but, what if you are trying to use this to permit *good* traffic?!

You just *know* that if you provide the ability to filter on flow labels
that some silly monkey will invent some horrendous hack where you have to
portknock on the SSH port with the flowlabel set to 0xBAA. Or "firewall"
their corporate network to only allow flowlables of 0x123 (and provide a
client that sets the flowlabel on all packets sent to that network to
0x123).

Oh! Huh! Nftable provides the "ipv6 flowlabel" matching primitive.
And I can just stuff (0xBAA & IPV6_FLOWINFO_FLOWLABEL) into flr_label...

Oh no... I'm the stupid monkey here...

:-P

W

>
> > at least if persistence for the
> > lifetime of a connection is required for that (see
> > http://www.maths.tcd.ie/~dwmalone/p/ec2nd05.pdf). For cases with no
> > connection state (unconnected UDP, forward and encapsulate), the flow
> > label is generated by parsing the packet to determine a hash based on
> > L3/L4 information.
> >
> > - Windows: I believe you mentioned that Windows 7 doesn't seem to have
> > support for setting flow labels.
>
> I couldn't find anything. Presumably it can be done by apps through the
> Winsock API, but that isn't very useful.
>
> > Maybe someone from Microsoft can
> > clarify this and let us know what the prospects are for getting flow
> > label support.
>
> Please.
>    Brian
>
> _______________________________________________
> v6ops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/v6ops
>