Date: Sat, 11 Apr 2020 23:23:32 +0100 From: Alexander V. Chernikov <melifaro@freebsd.org> To: "cem@freebsd.org" <cem@freebsd.org> Cc: svn-src-all <svn-src-all@freebsd.org>, svn-src-head <svn-src-head@freebsd.org>, src-committers <src-committers@freebsd.org> Subject: Re: svn commit: r359797 - in head/sys: net netinet netinet6 Message-ID: <6191651586642867@vla5-4a37cde0b550.qloud-c.yandex.net> In-Reply-To: <CAG6CVpUUxs5ztoOnSMHCHF9ppBmUTRh315HiQ6H5cYXbuXSaUQ@mail.gmail.com> References: <202004110737.03B7b8cS067986@repo.freebsd.org> <CAG6CVpXrVDso1i1Sq3KYVXi5%2BHyW7kwTYbq6C7otAPbCDWdgkg@mail.gmail.com> <6140881586636906@vla5-dcf36e533bf7.qloud-c.yandex.net> <CAG6CVpUUxs5ztoOnSMHCHF9ppBmUTRh315HiQ6H5cYXbuXSaUQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
11.04.2020, 22:28, "Conrad Meyer" <cem@freebsd.org>: > On Sat, Apr 11, 2020 at 1:45 PM Alexander V. Chernikov > <melifaro@freebsd.org> wrote: >> This number only affects selection of the outbound path in presence of multiple paths available for the same prefix. It means to mitigate hash polarization in the network ( https://www.cisco.com/c/en/us/support/docs/ip/express-forwarding-cef/116376-technote-cef-00.html contains somewhat relevant description). >> I don't think it that knowing the number make DoSing of the particular system easier. > > Thanks! Does it need to be stable over time, or would it be > acceptable to be updated at some point? If "at some point" means "after N hours/days" than the short answer is no. In the multi-layer CLOS-like networks people usually try to reduce the amount of churn, even in presence of some failures. Changing that number results in increased randomness around the traffic flow, which doesn't bring any obvious benefit. I could potentially imagine user being able to override the number, but typically vendors don't do that. > >> However, better quality randomness is always good. >> Speaking of "when" it is needed - you're right, it is needed pretty late in the boot process, after the userland starts. >> Will moving the order to SI_SUB_LAST help or I need to trigger number generation by different means? > > SI_SUB_LAST is better, sure. If you want to ensure you eventually get > a random number, and changing the number at runtime is acceptable, you > could have userspace induce seeding. But maybe that is unnecessarily Yep, that's a tradeoff between the ideal solution and implementation complexity. I was thinking of an approach when first rtsock connection triggers this generation, but that looks a bit ugly. If we have a good change to get somewhat decent entropy at SI_SUB_LAST, then I guess that's "good enough". > complex. Typical x86 systems using loader will have good entropy > available already at this point, outside of the installer or if there > is /boot corruption. > > (It sounds like this application would be fine with not really random > numbers, at least early in boot. We don't have a great API for that > need today, unfortunately.) Yep, for this value to be used, one need to install multipath route towards particular destination and it has to be actually used by the outbound traffic. Even if it is, nothing exceptionally bad will happen event with 0 value. > > Cheers, > Conrad
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6191651586642867>