Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

lib: actually hash all 16 bytes of IPv6 addresses, not just 4 (backport #17901) #18085

Merged
merged 6 commits into from
Feb 11, 2025

Conversation

mergify[bot]
Copy link

@mergify mergify bot commented Feb 11, 2025

Core change: We were hashing 4 bytes of the address. Even for IPv6 addresses. Oops.

Related changes:

  • went through all initializations and assignments of gate src and rmap_src to check that we're not feeding garbage into the 12 unused bytes and hash that
    • it should be noted that this was already the behavior before 2019 - all 16 bytes were unconditionally fed into the hash. This PR goes back to that behavior, but it is possible we might have accumulated places where we get junk data into the 12 padding bytes. Hence the cleanup patches in this PR.
    • rmap_src use is just… wrong… this does a best-effort fixup but it's only a bandaid.
  • since the original change with the 4 bytes was done to "speed up things" I've gone and refactored nexthop_hash as a whole. It just feeds a contiguous block of struct nexthop into jhash now, this should perform better than the jhash_word shenanigans we've gone to before.
  • topotest contributed by Donald, Thanks! 😃

this PR is incomplete, nhg_compare_nexthops needs to descend into ->resolved (cf. #16970, but that PR is also incomplete)

Unfortunately the test should only go red if both the compare and the hash are broken at the same time, so I'd prefer to also fix NHG comparison to see if fixing that (and having the hash broken) makes the test go green to validate that. But fixing the compare needs a bit more work (I'll keep updating this PR)


This is an automatic backport of pull request #17901 done by Mergify.

While the loop is currently exited in all cases after using nexthop, it
is a footgun to have "nh" around to be reused in another iteration of
the loop.  This would leave nexthop with partial data from the previous
use.  Make it local where needed instead.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
(cherry picked from commit ce7f5b2)
Zero out the 12 unused bytes (for the IPv6 address) when reading in an
IPv4 address.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
(cherry picked from commit 95cf0b2)
Doesn't seem to break anything but really poor style to pass potentially
uninitialized data to hash_lookup.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
(cherry picked from commit c88589f)
rmap_src wasn't initialized, so for IPv4 the unused 12 bytes would
contain whatever junk is on the stack on function entry.  Also move
the IPv4 parse before the IPv6 parse so if it's successful we can be
sure the other bytes haven't been touched.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
(cherry picked from commit b666ee5)
When reading in a nexthop from ZAPI, only set the fields that actually
have meaning.  While it shouldn't happen to begin with, we can otherwise
carry padding garbage into the unused leftover union bytes.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
(cherry picked from commit 4a0e141)
We were hashing 4 bytes of the address.  Even for IPv6 addresses.

Oops.

The reason this was done was to try to make it faster, but made a
complex maze out of everything.  Time for a refactor.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
(cherry picked from commit 001fcfa)
@Jafaral Jafaral merged commit ba2b639 into stable/10.1 Feb 11, 2025
22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants