Commit 65e90246 authored by Willem de Bruijn's avatar Willem de Bruijn Committed by Paolo Abeni
Browse files

ip: load balance tcp connections to single dst addr and port 



Load balance new TCP connections across nexthops also when they
connect to the same service at a single remote address and port.

This affects only port-based multipath hashing:
fib_multipath_hash_policy 1 or 3.

Local connections must choose both a source address and port when
connecting to a remote service, in ip_route_connect. This
"chicken-and-egg problem" (commit 2d7192d6 ("ipv4: Sanitize and
simplify ip_route_{connect,newports}()")) is resolved by first
selecting a source address, by looking up a route using the zero
wildcard source port and address.

As a result multiple connections to the same destination address and
port have no entropy in fib_multipath_hash.

This is not a problem when forwarding, as skb-based hashing has a
4-tuple. Nor when establishing UDP connections, as autobind there
selects a port before reaching ip_route_connect.

Load balance also TCP, by using a random port in fib_multipath_hash.
Port assignment in inet_hash_connect is not atomic with
ip_route_connect. Thus ports are unpredictable, effectively random.

Implementation details:

Do not actually pass a random fl4_sport, as that affects not only
hashing, but routing more broadly, and can match a source port based
policy route, which existing wildcard port 0 will not. Instead,
define a new wildcard flowi flag that is used only for hashing.

Selecting a random source is equivalent to just selecting a random
hash entirely. But for code clarity, follow the normal 4-tuple hash
process and only update this field.

fib_multipath_hash can be reached with zero sport from other code
paths, so explicitly pass this flowi flag, rather than trying to infer
this case in the function itself.

Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Reviewed-by: default avatarIdo Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20250424143549.669426-3-willemdebruijn.kernel@gmail.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent 32607a33

include/net/flow.h

+1 −0
Original line number Diff line number Diff line
@@ -39,6 +39,7 @@ struct flowi_common { 
#define FLOWI_FLAG_ANYSRC		0x01

#define FLOWI_FLAG_KNOWN_NH		0x02

#define FLOWI_FLAG_L3MDEV_OIF		0x04

#define FLOWI_FLAG_ANY_SPORT		0x08

	__u32	flowic_secid;

	kuid_t  flowic_uid;

	__u32		flowic_multipath_hash;

include/net/route.h

+3 −0
Original line number Diff line number Diff line
@@ -326,6 +326,9 @@ static inline void ip_route_connect_init(struct flowi4 *fl4, __be32 dst, 
	if (inet_test_bit(TRANSPARENT, sk))

		flow_flags |= FLOWI_FLAG_ANYSRC;



	if (IS_ENABLED(CONFIG_IP_ROUTE_MULTIPATH) && !sport)

		flow_flags |= FLOWI_FLAG_ANY_SPORT;



	flowi4_init_output(fl4, oif, READ_ONCE(sk->sk_mark), ip_sock_rt_tos(sk),

			   ip_sock_rt_scope(sk), protocol, flow_flags, dst,

			   src, dport, sport, sk->sk_uid);

net/ipv4/route.c

+10 −3
Original line number Diff line number Diff line
@@ -2037,8 +2037,12 @@ static u32 fib_multipath_custom_hash_fl4(const struct net *net, 
		hash_keys.addrs.v4addrs.dst = fl4->daddr;

	if (hash_fields & FIB_MULTIPATH_HASH_FIELD_IP_PROTO)

		hash_keys.basic.ip_proto = fl4->flowi4_proto;

	if (hash_fields & FIB_MULTIPATH_HASH_FIELD_SRC_PORT)

	if (hash_fields & FIB_MULTIPATH_HASH_FIELD_SRC_PORT) {

		if (fl4->flowi4_flags & FLOWI_FLAG_ANY_SPORT)

			hash_keys.ports.src = (__force __be16)get_random_u16();

		else

			hash_keys.ports.src = fl4->fl4_sport;

	}

	if (hash_fields & FIB_MULTIPATH_HASH_FIELD_DST_PORT)

		hash_keys.ports.dst = fl4->fl4_dport;
@@ -2093,6 +2097,9 @@ int fib_multipath_hash(const struct net *net, const struct flowi4 *fl4, 
			hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;

			hash_keys.addrs.v4addrs.src = fl4->saddr;

			hash_keys.addrs.v4addrs.dst = fl4->daddr;

			if (fl4->flowi4_flags & FLOWI_FLAG_ANY_SPORT)

				hash_keys.ports.src = (__force __be16)get_random_u16();

			else

				hash_keys.ports.src = fl4->fl4_sport;

			hash_keys.ports.dst = fl4->fl4_dport;

			hash_keys.basic.ip_proto = fl4->flowi4_proto;

net/ipv6/route.c

+10 −3
Original line number Diff line number Diff line
@@ -2492,8 +2492,12 @@ static u32 rt6_multipath_custom_hash_fl6(const struct net *net, 
		hash_keys.basic.ip_proto = fl6->flowi6_proto;

	if (hash_fields & FIB_MULTIPATH_HASH_FIELD_FLOWLABEL)

		hash_keys.tags.flow_label = (__force u32)flowi6_get_flowlabel(fl6);

	if (hash_fields & FIB_MULTIPATH_HASH_FIELD_SRC_PORT)

	if (hash_fields & FIB_MULTIPATH_HASH_FIELD_SRC_PORT) {

		if (fl6->flowi6_flags & FLOWI_FLAG_ANY_SPORT)

			hash_keys.ports.src = (__force __be16)get_random_u16();

		else

			hash_keys.ports.src = fl6->fl6_sport;

	}

	if (hash_fields & FIB_MULTIPATH_HASH_FIELD_DST_PORT)

		hash_keys.ports.dst = fl6->fl6_dport;
@@ -2547,6 +2551,9 @@ u32 rt6_multipath_hash(const struct net *net, const struct flowi6 *fl6, 
			hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;

			hash_keys.addrs.v6addrs.src = fl6->saddr;

			hash_keys.addrs.v6addrs.dst = fl6->daddr;

			if (fl6->flowi6_flags & FLOWI_FLAG_ANY_SPORT)

				hash_keys.ports.src = (__force __be16)get_random_u16();

			else

				hash_keys.ports.src = fl6->fl6_sport;

			hash_keys.ports.dst = fl6->fl6_dport;

			hash_keys.basic.ip_proto = fl6->flowi6_proto;

net/ipv6/tcp_ipv6.c

+2 −0
Original line number Diff line number Diff line
@@ -267,6 +267,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, 
	fl6.flowi6_mark = sk->sk_mark;

	fl6.fl6_dport = usin->sin6_port;

	fl6.fl6_sport = inet->inet_sport;

	if (IS_ENABLED(CONFIG_IP_ROUTE_MULTIPATH) && !fl6.fl6_sport)

		fl6.flowi6_flags = FLOWI_FLAG_ANY_SPORT;

	fl6.flowi6_uid = sk->sk_uid;



	opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));