* [PATCH net-next v8 0/2] tcp: rehash onto different local ECMP path on retransmit timeout
@ 2026-05-22 21:57 Neil Spring
2026-05-22 21:57 ` [PATCH net-next v8 1/2] " Neil Spring
2026-05-22 21:57 ` [PATCH net-next v8 2/2] selftests: net: add local ECMP rehash test Neil Spring
0 siblings, 2 replies; 3+ messages in thread
From: Neil Spring @ 2026-05-22 21:57 UTC (permalink / raw)
To: netdev
Cc: edumazet, ncardwell, kuniyu, davem, kuba, dsahern, pabeni, horms,
shuah, linux-kselftest, ntspring, bpf, martin.lau, daniel
Currently sk_rethink_txhash() re-rolls the socket's txhash on RTO,
PLB, and spurious-retransmission events, but the new hash is not
propagated into the IPv6 ECMP path selection logic. The cached
route is reused and fib6_select_path() is never re-invoked, so
so the connection uses the same local ECMP decision.
This series adds the two missing pieces:
1. __sk_dst_reset() alongside sk_rethink_txhash() so the cached dst
is invalidated and the next transmit triggers a fresh route lookup.
2. fl6->mp_hash set from sk_txhash before each route lookup so
fib6_select_path() picks a path based on the (potentially re-rolled)
hash. This is conditioned on fib_multipath_hash_policy == 0 (L3)
because policies 1-3 compute a deterministic hash from the flow
keys which must not be overridden.
Patch 1 is the kernel change; patch 2 adds selftests covering SYN
rehash, SYN/ACK rehash, midstream RTO rehash, midstream ACK rehash
(spurious retransmission), PLB rehash, a policy 1 negative test,
a flowlabel leak regression test, two dst rebuild consistency
tests (normal and syncookie) verifying that natural route
invalidation does not cause unintended path changes, and a
syncookie server path consistency test verifying that the SYN-ACK
and post-cookie ACKs use the same ECMP nexthop.
I'd like guidance on whether to use the ISN as txhash when using
syncookies; it keeps the SYN-ACK and subsequent data path consistent,
but one could argue that this consistency doesn't matter because no
reordering is possible.
Changes since v7: https://lore.kernel.org/netdev/20260520064310.4154268-1-ntspring@meta.com/
Patch 1:
- Remove #if IS_ENABLED(CONFIG_IPV6) guards around __sk_dst_reset()
in tcp_plb.c and tcp_timer.c (Eric Dumazet)
- Guard mp_hash in inet6_csk_route_socket() on sk_protocol == IPPROTO_TCP
instead of txhash != 0, since non-TCP callers like L2TP set sk_txhash
in __ip6_datagram_connect() and should retain flow-key-based ECMP
- Use the syncookie (ISN) as txhash for both the SYN-ACK route lookup
and cookie_v6_check() socket creation, so the server's ECMP selection is
consistent across the stateless SYN-ACK and the subsequent full socket.
Move cookie_init_sequence() before route_req() in tcp_conn_request()
so the SYN-ACK dst is computed with the cookie-derived txhash; derive
txhash from snt_isn in cookie_tcp_reqsk_init() to match
Patch 2:
- Invalidate dst via dummy route add/del instead of route replace to
avoid a transient single-nexthop state during multipath replacement
- Add syncookie server path consistency test verifying the SYN-ACK and
post-cookie ACKs use the same ECMP path
- Strengthen policy 1 negative test to wait for multiple rehash attempts
and verify SYNs landed on exactly one interface
Changes since v6: https://lore.kernel.org/netdev/20260517174522.2232057-1-ntspring@meta.com/
- Guard mp_hash assignment so that non-TCP callers of
inet6_csk_route_socket() fall through to rt6_multipath_hash()
(superseded in v8 by sk_protocol == IPPROTO_TCP guard)
- Initialize txhash in bpf_sk_assign_tcp_reqsk() to avoid reading
uninitialized slab memory in inet6_csk_route_req()
- Check post-rebuild busywait return status to avoid silent false pass
Changes since v5: https://lore.kernel.org/netdev/20260513204048.2721843-1-ntspring@meta.com/
- Improve selftest reliability: suppress __dst_negative_advice() via
tcp_retries1=255 in dst rebuild tests so a real RTO cannot trigger
an unintended rehash; add internal retry to midstream and ACK
rehash tests to tolerate probabilistic ECMP path selection; fix
midstream baseline capture to account for packets that bypass tc
filters during the prio qdisc's TCQ_F_CAN_BYPASS window
- Increase ECMP_REBUILD_ROUNDS default to 10 for reliable regression
detection with 2-way ECMP; replace sleep with busywait
- Use tcp_allowed_congestion_control instead of changing the host's
default congestion control for PLB test
- Use (txhash >> 1) ?: 1 to guarantee non-zero mp_hash, since zero
falls back to rt6_multipath_hash()
Changes since v4: https://lore.kernel.org/netdev/20260507171319.1259115-1-ntspring@meta.com/
- Condition fl6->mp_hash on fib_multipath_hash_policy == 0 to preserve
deterministic hash policies 1-3 (e.g., symmetric 5-tuple for policy 1)
- Set fl6->mp_hash in tcp_v6_connect() and cookie_v6_check() for
initial route lookup consistency; move sk_set_txhash() earlier
(Jakub Kicinski)
- Add policy 1 negative test; improve sysctl save/restore
- Add flowlabel leak test confirming mp_hash does not alter the
on-wire IPv6 flow label
- Add dst rebuild consistency tests (normal and syncookie) verifying
that route table changes do not cause unintended ECMP path changes
Changes since v3: https://lore.kernel.org/netdev/20260505193824.2791642-1-ntspring@meta.com/
- Use __sk_dst_reset() instead of sk_dst_reset() since the socket lock
is held in all three call sites (Eric Dumazet)
- Guard __sk_dst_reset() with sk->sk_family == AF_INET6 since IPv4 ECMP
does not use sk_txhash for path selection
- Guard __sk_dst_reset() in tcp_plb_check_rehash() with the return value
of sk_rethink_txhash()
- Move tcp_rsk(req)->txhash initialization before route_req() in
tcp_conn_request() to avoid reading uninitialized memory
- Add CONFIG_TCP_CONG_DCTCP=m to selftests/net/config for PLB test
- Skip PLB test gracefully if DCTCP is not available
- Save and restore original congestion control algorithm in PLB test
- Default get_netstat_counter() to 0 when counter is not found
- Skip all tests if tcp_syn_linear_timeouts is not available
- Replace bash/pipe data sources with socat OPEN:/dev/zero for
cleaner process cleanup
- Fix shellcheck warnings
Changes since v2: https://lore.kernel.org/netdev/20260408070514.1840227-1-ntspring@meta.com/
- Retitle "ECMP" to "local ECMP" to distinguish from remote ECMP
(Neal Cardwell)
- Add fl6->mp_hash propagation in inet6_sk_rebuild_header() (af_inet6.c),
covering the dst rebuild path used on established sockets
- Remove incorrect ir_iif update from tcp_check_req() in tcp_minisocks.c;
the SYN/ACK rehash is already handled by tcp_rtx_synack() re-rolling
txhash which feeds into inet6_csk_route_req()'s mp_hash
(Eric Dumazet)
- Add ACK rehash and PLB rehash selftests
- Improve selftest reliability
Changes since v1: https://lore.kernel.org/netdev/20260408002802.2448424-1-ntspring@meta.com/
- Use tcp_rsk(req)->txhash instead of jhash_1word(req->num_retrans, ...)
for ECMP path selection in inet6_csk_route_req(), making the request
socket path consistent with the established socket path (Eric Dumazet)
- Add comments explaining the >> 1 shift for 31-bit mp_hash range
- Use socat -u (unidirectional) in selftest to avoid SIGPIPE race
- Increase tcp_syn_retries and tcp_syn_linear_timeouts to 25 for
better rehash coverage
Neil Spring (2):
tcp: rehash onto different local ECMP path on retransmit timeout
selftests: net: add local ECMP rehash test
net/core/filter.c | 1 +
net/ipv4/tcp_input.c | 6 +-
net/ipv4/tcp_plb.c | 5 +-
net/ipv4/tcp_timer.c | 2 +
net/ipv6/af_inet6.c | 3 +
net/ipv6/inet6_connection_sock.c | 7 +
net/ipv6/syncookies.c | 4 +
net/ipv6/tcp_ipv6.c | 13 +-
tools/testing/selftests/net/Makefile | 1 +
tools/testing/selftests/net/config | 1 +
tools/testing/selftests/net/ecmp_rehash.sh | 952 +++++++++++++++++++++
11 files changed, 990 insertions(+), 5 deletions(-)
create mode 100755 tools/testing/selftests/net/ecmp_rehash.sh
--
2.53.0-Meta
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH net-next v8 1/2] tcp: rehash onto different local ECMP path on retransmit timeout
2026-05-22 21:57 [PATCH net-next v8 0/2] tcp: rehash onto different local ECMP path on retransmit timeout Neil Spring
@ 2026-05-22 21:57 ` Neil Spring
2026-05-22 21:57 ` [PATCH net-next v8 2/2] selftests: net: add local ECMP rehash test Neil Spring
1 sibling, 0 replies; 3+ messages in thread
From: Neil Spring @ 2026-05-22 21:57 UTC (permalink / raw)
To: netdev
Cc: edumazet, ncardwell, kuniyu, davem, kuba, dsahern, pabeni, horms,
shuah, linux-kselftest, ntspring, bpf, martin.lau, daniel
Currently sk_rethink_txhash() re-rolls the socket's txhash on RTO, PLB,
and spurious-retransmission events, but the cached route is reused and
the new hash is not propagated into the ECMP path selection logic. Two
changes are needed to make rehash select a different local ECMP path:
1. Add __sk_dst_reset() alongside sk_rethink_txhash() in
tcp_write_timeout(), tcp_rcv_spurious_retrans(), and
tcp_plb_check_rehash() so the cached dst is invalidated and the
next transmit triggers a fresh route lookup.
2. Set fl6->mp_hash from sk_txhash (or tcp_rsk(req)->txhash for
SYN/ACK retransmits and syncookies) in tcp_v6_connect(),
inet6_sk_rebuild_header(), inet6_csk_route_req(),
inet6_csk_route_socket(), and cookie_v6_check() so
fib6_select_path() picks a path based on the new hash.
The mp_hash assignment in inet6_csk_route_socket() is guarded
by sk_protocol == IPPROTO_TCP so that non-TCP callers (e.g.,
L2TP via inet6_csk_xmit) fall through to rt6_multipath_hash()
and retain their existing flow-key-based ECMP behavior. The
expression uses (txhash >> 1) ?: 1 so that the rare txhash == 1
still produces a valid non-zero mp_hash.
This is conditioned on fib_multipath_hash_policy == 0 (L3)
because policies 1-3 compute a deterministic hash from the
flow keys (e.g., symmetric 5-tuple for policy 1) which must
not be overridden by a random txhash.
It is necessary to update mp_hash explicitly because the
default ECMP hash derives from fl6->flowlabel via
np->flow_label, which is not updated from sk_txhash
(REPFLOW is off by default). ip6_make_flowlabel() cannot
help either, as it runs after the route lookup.
sk_set_txhash() is moved before ip6_dst_lookup_flow() in
tcp_v6_connect() so the initial ECMP path is selected by the same
txhash that subsequent route rebuilds will use. This avoids
unintended path changes when the cached dst is naturally
invalidated (e.g., by PMTU discovery or route changes).
The dst reset is guarded by sk->sk_family == AF_INET6 since IPv4
ECMP does not currently use sk_txhash for path selection. For
IPv4-mapped IPv6 sockets this produces a redundant dst reset on a
cold path (RTO/PLB); the subsequent IPv4 route lookup returns the
same result.
tcp_rsk(req)->txhash initialization is moved before route_req() in
tcp_conn_request() so that inet6_csk_route_req() reads a valid hash
on the initial SYN/ACK. For syncookies, txhash is set to the cookie
(ISN) before route_req() so the SYN-ACK uses the same ECMP path that
cookie_v6_check() will select when the ACK arrives and the full socket
is created. cookie_tcp_reqsk_init() likewise derives txhash from the
cookie rather than calling net_tx_rndhash(), since the original request
socket (and its txhash) was freed after the SYN-ACK. The ecn_ok
clear for syncookies without timestamps stays after
tcp_ecn_create_request() so it takes precedence.
bpf_sk_assign_tcp_reqsk() is updated to initialize txhash via
net_tx_rndhash(), matching cookie_tcp_reqsk_alloc(). Without this,
inet6_csk_route_req() would read uninitialized slab memory from
request sockets created by BPF syncookies.
Signed-off-by: Neil Spring <ntspring@meta.com>
---
net/core/filter.c | 1 +
net/ipv4/syncookies.c | 8 +++++++-
net/ipv4/tcp_input.c | 18 +++++++++++-------
net/ipv4/tcp_plb.c | 5 ++++-
net/ipv4/tcp_timer.c | 2 ++
net/ipv6/af_inet6.c | 3 +++
net/ipv6/inet6_connection_sock.c | 8 ++++++++
net/ipv6/syncookies.c | 4 ++++
net/ipv6/tcp_ipv6.c | 13 +++++++++++--
9 files changed, 51 insertions(+), 11 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index 80a3b702a2d4..7fea9ad881e7 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -12301,6 +12301,7 @@ __bpf_kfunc int bpf_sk_assign_tcp_reqsk(struct __sk_buff *s, struct sock *sk,
treq->req_usec_ts = !!attrs->usec_ts_ok;
treq->ts_off = tsoff;
+ treq->txhash = net_tx_rndhash();
skb_orphan(skb);
skb->sk = req_to_sk(req);
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index df479277fb80..8591f2606ca6 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -280,9 +280,15 @@ static int cookie_tcp_reqsk_init(struct sock *sk, struct sk_buff *skb,
treq->snt_synack = 0;
treq->snt_tsval_first = 0;
treq->tfo_listener = false;
- treq->txhash = net_tx_rndhash();
treq->rcv_isn = ntohl(th->seq) - 1;
treq->snt_isn = ntohl(th->ack_seq) - 1;
+ /* Use the cookie as txhash so the ECMP path matches the
+ * SYN-ACK, where txhash was also set to the cookie. A
+ * random txhash would be inconsistent because the original
+ * request socket (and its txhash) was freed after sending
+ * the SYN-ACK.
+ */
+ treq->txhash = treq->snt_isn;
treq->syn_tos = TCP_SKB_CB(skb)->ip_dsfield;
#if IS_ENABLED(CONFIG_MPTCP)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 7995a89bafc9..810c95a11c8c 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5020,8 +5020,10 @@ static void tcp_rcv_spurious_retrans(struct sock *sk,
skb->protocol == htons(ETH_P_IPV6) &&
(tcp_sk(sk)->inet_conn.icsk_ack.lrcv_flowlabel !=
ntohl(ip6_flowlabel(ipv6_hdr(skb)))) &&
- sk_rethink_txhash(sk))
+ sk_rethink_txhash(sk)) {
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPDUPLICATEDATAREHASH);
+ __sk_dst_reset(sk);
+ }
/* Save last flowlabel after a spurious retrans. */
tcp_save_lrcv_flowlabel(sk, skb);
@@ -7636,6 +7638,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
tcp_rsk(req)->af_specific = af_ops;
tcp_rsk(req)->ts_off = 0;
tcp_rsk(req)->req_usec_ts = false;
+ tcp_rsk(req)->txhash = net_tx_rndhash();
#if IS_ENABLED(CONFIG_MPTCP)
tcp_rsk(req)->is_mptcp = 0;
#endif
@@ -7659,6 +7662,11 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
/* Note: tcp_v6_init_req() might override ir_iif for link locals */
inet_rsk(req)->ir_iif = inet_request_bound_dev_if(sk, skb);
+ if (want_cookie) {
+ isn = cookie_init_sequence(af_ops, sk, skb, &req->mss);
+ tcp_rsk(req)->txhash = isn;
+ }
+
dst = af_ops->route_req(sk, skb, &fl, req, isn);
if (!dst)
goto drop_and_free;
@@ -7698,11 +7706,8 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
tcp_ecn_create_request(req, skb, sk, dst);
- if (want_cookie) {
- isn = cookie_init_sequence(af_ops, sk, skb, &req->mss);
- if (!tmp_opt.tstamp_ok)
- inet_rsk(req)->ecn_ok = 0;
- }
+ if (want_cookie && !tmp_opt.tstamp_ok)
+ inet_rsk(req)->ecn_ok = 0;
#ifdef CONFIG_TCP_AO
if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh))
@@ -7717,7 +7722,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
}
#endif
tcp_rsk(req)->snt_isn = isn;
- tcp_rsk(req)->txhash = net_tx_rndhash();
tcp_rsk(req)->syn_tos = TCP_SKB_CB(skb)->ip_dsfield;
tcp_openreq_init_rwin(req, sk, dst);
sk_rx_queue_set(req_to_sk(req), skb);
diff --git a/net/ipv4/tcp_plb.c b/net/ipv4/tcp_plb.c
index c11a0cd3f8fe..849ac4aad480 100644
--- a/net/ipv4/tcp_plb.c
+++ b/net/ipv4/tcp_plb.c
@@ -78,7 +78,10 @@ void tcp_plb_check_rehash(struct sock *sk, struct tcp_plb_state *plb)
if (plb->pause_until)
return;
- sk_rethink_txhash(sk);
+ if (sk_rethink_txhash(sk)) {
+ if (sk->sk_family == AF_INET6)
+ __sk_dst_reset(sk);
+ }
plb->consec_cong_rounds = 0;
WRITE_ONCE(tcp_sk(sk)->plb_rehash, tcp_sk(sk)->plb_rehash + 1);
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPPLBREHASH);
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 322db13333c7..7c05f1072a06 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -300,6 +300,8 @@ static int tcp_write_timeout(struct sock *sk)
if (sk_rethink_txhash(sk)) {
WRITE_ONCE(tp->timeout_rehash, tp->timeout_rehash + 1);
__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPTIMEOUTREHASH);
+ if (sk->sk_family == AF_INET6)
+ __sk_dst_reset(sk);
}
return 0;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 0a88b376141d..7a2b1de7487c 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -823,6 +823,9 @@ int inet6_sk_rebuild_header(struct sock *sk)
fl6->flowi6_uid = sk_uid(sk);
security_sk_classify_flow(sk, flowi6_to_flowi_common(fl6));
+ if (ip6_multipath_hash_policy(sock_net(sk)) == 0 && sk->sk_txhash)
+ fl6->mp_hash = (sk->sk_txhash >> 1) ?: 1;
+
rcu_read_lock();
final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &np->final);
rcu_read_unlock();
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 37534e116899..7ca24eef614c 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -48,6 +48,10 @@ struct dst_entry *inet6_csk_route_req(const struct sock *sk,
fl6->flowi6_uid = sk_uid(sk);
security_req_classify_flow(req, flowi6_to_flowi_common(fl6));
+ if (ip6_multipath_hash_policy(sock_net(sk)) == 0 &&
+ tcp_rsk(req)->txhash)
+ fl6->mp_hash = (tcp_rsk(req)->txhash >> 1) ?: 1;
+
if (!dst) {
dst = ip6_dst_lookup_flow(sock_net(sk), sk, fl6, final_p);
if (IS_ERR(dst))
@@ -70,6 +74,10 @@ struct dst_entry *inet6_csk_route_socket(struct sock *sk,
fl6->saddr = np->saddr;
fl6->flowlabel = np->flow_label;
IP6_ECN_flow_xmit(sk, fl6->flowlabel);
+
+ if (sk->sk_protocol == IPPROTO_TCP &&
+ ip6_multipath_hash_policy(sock_net(sk)) == 0 && sk->sk_txhash)
+ fl6->mp_hash = (sk->sk_txhash >> 1) ?: 1;
fl6->flowi6_oif = sk->sk_bound_dev_if;
fl6->flowi6_mark = sk->sk_mark;
fl6->fl6_sport = inet->inet_sport;
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 4f6f0d751d6c..70759cd64b34 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -245,6 +245,10 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
fl6.flowi6_uid = sk_uid(sk);
security_req_classify_flow(req, flowi6_to_flowi_common(&fl6));
+ if (ip6_multipath_hash_policy(net) == 0 &&
+ tcp_rsk(req)->txhash)
+ fl6.mp_hash = (tcp_rsk(req)->txhash >> 1) ?: 1;
+
dst = ip6_dst_lookup_flow(net, sk, &fl6, final_p);
if (IS_ERR(dst)) {
SKB_DR_SET(reason, IP_OUTNOROUTES);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 2c3f7a739709..ecdc8f84d203 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -258,6 +258,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr_unsized *uaddr,
if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
saddr = &sk->sk_v6_rcv_saddr;
+ sk_set_txhash(sk);
+
fl6->flowi6_proto = IPPROTO_TCP;
fl6->daddr = sk->sk_v6_daddr;
fl6->saddr = saddr ? *saddr : np->saddr;
@@ -275,6 +277,15 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr_unsized *uaddr,
security_sk_classify_flow(sk, flowi6_to_flowi_common(fl6));
+ /* Non-zero mp_hash bypasses rt6_multipath_hash() in
+ * fib6_select_path(), letting txhash control ECMP path
+ * selection so that sk_rethink_txhash() rehashes onto a
+ * different path. Policies 1-3 derive a deterministic
+ * hash from the flow keys and must not be overridden.
+ */
+ if (ip6_multipath_hash_policy(net) == 0 && sk->sk_txhash)
+ fl6->mp_hash = (sk->sk_txhash >> 1) ?: 1;
+
dst = ip6_dst_lookup_flow(net, sk, fl6, final_p);
if (IS_ERR(dst)) {
err = PTR_ERR(dst);
@@ -313,8 +324,6 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr_unsized *uaddr,
if (err)
goto late_failure;
- sk_set_txhash(sk);
-
if (likely(!tp->repair)) {
union tcp_seq_and_ts_off st;
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH net-next v8 2/2] selftests: net: add local ECMP rehash test
2026-05-22 21:57 [PATCH net-next v8 0/2] tcp: rehash onto different local ECMP path on retransmit timeout Neil Spring
2026-05-22 21:57 ` [PATCH net-next v8 1/2] " Neil Spring
@ 2026-05-22 21:57 ` Neil Spring
1 sibling, 0 replies; 3+ messages in thread
From: Neil Spring @ 2026-05-22 21:57 UTC (permalink / raw)
To: netdev
Cc: edumazet, ncardwell, kuniyu, davem, kuba, dsahern, pabeni, horms,
shuah, linux-kselftest, ntspring, bpf, martin.lau, daniel
Add ecmp_rehash.sh with ten scenarios verifying that TCP rehash
selects a different local ECMP path for IPv6:
- SYN retransmission (forward path blocked during setup)
- SYN/ACK retransmission (reverse path blocked during setup)
- Midstream RTO (forward path blocked on established connection)
- Midstream ACK rehash (reverse path blocked on established connection)
- PLB rehash (ECN-driven congestion on established connection)
- Hash policy 1 negative test (rehash attempted but path unchanged)
- No flowlabel leak (client mp_hash does not alter on-wire flowlabel)
- Dst rebuild consistency (dst invalidation does not change path)
- Dst rebuild consistency with syncookies (server socket created
via cookie_v6_check instead of the normal three-way handshake)
- Syncookie server path consistency (SYN-ACK and post-cookie ACKs
use the same ECMP path)
The policy 1 test verifies that fib_multipath_hash_policy=1 computes
a deterministic 5-tuple hash, so txhash re-rolls do not change the
ECMP path while TcpTimeoutRehash still increments.
The flowlabel leak test sets auto_flowlabels=0 on the client and
installs tc filters on client egress that drop TCP packets with
nonzero flowlabel, confirming that the client's fl6->mp_hash does
not leak into the on-wire IPv6 flow label.
The dst rebuild tests stream data, invalidate the cached dst by
adding and removing a dummy route (bumping the fib6_node sernum),
and verify that traffic stays on the same path. The sernum change
causes ip6_dst_check() to fail on the next transmit, triggering a
fresh route lookup via inet6_csk_route_socket().
ECMP_REBUILD_ROUNDS=10 repeats the check to reduce the probability
of a buggy kernel passing by chance with 2-way ECMP.
The syncookie server path consistency test verifies that the
server's SYN-ACK and subsequent ACKs use the same ECMP path.
With syncookies, the request socket is freed after the SYN-ACK,
so cookie_tcp_reqsk_init() must derive the same txhash (from the
cookie) that was used for the SYN-ACK's route lookup.
Signed-off-by: Neil Spring <ntspring@meta.com>
---
tools/testing/selftests/net/Makefile | 1 +
tools/testing/selftests/net/config | 1 +
tools/testing/selftests/net/ecmp_rehash.sh | 1036 ++++++++++++++++++++
3 files changed, 1038 insertions(+)
create mode 100755 tools/testing/selftests/net/ecmp_rehash.sh
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index baa30287cf22..6ec1b24218ad 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -26,6 +26,7 @@ TEST_PROGS := \
cmsg_time.sh \
double_udp_encap.sh \
drop_monitor_tests.sh \
+ ecmp_rehash.sh \
fcnal-ipv4.sh \
fcnal-ipv6.sh \
fcnal-other.sh \
diff --git a/tools/testing/selftests/net/config b/tools/testing/selftests/net/config
index 94d722770420..20fce6e4500b 100644
--- a/tools/testing/selftests/net/config
+++ b/tools/testing/selftests/net/config
@@ -122,6 +122,7 @@ CONFIG_PSAMPLE=m
CONFIG_RPS=y
CONFIG_SYSFS=y
CONFIG_TAP=m
+CONFIG_TCP_CONG_DCTCP=m
CONFIG_TCP_MD5SIG=y
CONFIG_TEST_BLACKHOLE_DEV=m
CONFIG_TEST_BPF=m
diff --git a/tools/testing/selftests/net/ecmp_rehash.sh b/tools/testing/selftests/net/ecmp_rehash.sh
new file mode 100755
index 000000000000..407b35f667e7
--- /dev/null
+++ b/tools/testing/selftests/net/ecmp_rehash.sh
@@ -0,0 +1,1036 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Test local ECMP path re-selection on TCP retransmission timeout and PLB.
+#
+# Two namespaces connected by two parallel veth pairs with a 2-way ECMP
+# route. When a TCP path is blocked (via tc drop) or congested (via
+# netem ECN marking), the kernel rehashes the connection via
+# sk_rethink_txhash() + __sk_dst_reset(), causing the next route lookup
+# to select the other ECMP path.
+#
+# Expected runtime: ~15 seconds. The large timeouts in individual tests
+# (slowwait 30-60s, socat connect-timeout=60-120s) are worst-case bounds
+# that are never reached on a correctly functioning kernel.
+
+source lib.sh
+
+SUBNETS=(a b)
+PORT=9900
+: "${ECMP_REBUILD_ROUNDS:=10}"
+
+ALL_TESTS="
+ test_ecmp_syn_rehash
+ test_ecmp_synack_rehash
+ test_ecmp_midstream_rehash
+ test_ecmp_midstream_ack_rehash
+ test_ecmp_plb_rehash
+ test_ecmp_hash_policy1_no_rehash
+ test_ecmp_no_flowlabel_leak
+ test_ecmp_dst_rebuild_consistency
+ test_ecmp_dst_rebuild_syncookie_consistency
+ test_ecmp_syncookie_path_consistency
+"
+
+link_tx_packets_get()
+{
+ local ns=$1; shift
+ local dev=$1; shift
+
+ ip netns exec "$ns" cat "/sys/class/net/$dev/statistics/tx_packets"
+}
+
+# Return the number of packets matched by the tc filter action on a device.
+# When tc drops packets via "action drop", the device's tx_packets is not
+# incremented (packet never reaches veth_xmit), but the tc action maintains
+# its own counter.
+tc_filter_pkt_count()
+{
+ local ns=$1; shift
+ local dev=$1; shift
+
+ ip netns exec "$ns" tc -s filter show dev "$dev" parent 1: 2>/dev/null |
+ awk '/Sent .* pkt/ {
+ for (i=1; i<=NF; i++)
+ if ($i == "pkt") { print $(i-1); exit }
+ }'
+}
+
+# Read a TcpExt counter from /proc/net/netstat in a namespace.
+# Returns 0 if the counter is not found.
+get_netstat_counter()
+{
+ local ns=$1; shift
+ local field=$1; shift
+ local val
+
+ # shellcheck disable=SC2016
+ val=$(ip netns exec "$ns" awk -v key="$field" '
+ /^TcpExt:/ {
+ if (!h) { split($0, n); h=1 }
+ else {
+ split($0, v)
+ for (i in n)
+ if (n[i] == key) print v[i]
+ }
+ }
+ ' /proc/net/netstat)
+ echo "${val:-0}"
+}
+
+# Apply netem ECN marking: CE-mark all ECT packets instead of dropping them.
+mark_ecn()
+{
+ local ns=$1; shift
+ local dev=$1; shift
+
+ ip netns exec "$ns" tc qdisc add dev "$dev" root netem loss 100% ecn
+}
+
+# Block TCP (IPv6 next-header = 6) egress, allowing ICMPv6 through.
+block_tcp()
+{
+ local ns=$1; shift
+ local dev=$1; shift
+
+ ip netns exec "$ns" tc qdisc add dev "$dev" root handle 1: prio
+ ip netns exec "$ns" tc filter add dev "$dev" parent 1: \
+ protocol ipv6 prio 1 u32 match u8 0x06 0xff at 6 action drop
+}
+
+unblock_tcp()
+{
+ local ns=$1; shift
+ local dev=$1; shift
+
+ ip netns exec "$ns" tc qdisc del dev "$dev" root 2>/dev/null
+}
+
+# Return success when a device's TX counter exceeds a baseline value.
+dev_tx_packets_above()
+{
+ local ns=$1; shift
+ local dev=$1; shift
+ local baseline=$1; shift
+
+ local cur
+ cur=$(link_tx_packets_get "$ns" "$dev")
+ [ "$cur" -gt "$baseline" ]
+}
+
+# Return success when both devices have dropped at least one TCP packet.
+both_devs_attempted()
+{
+ local ns=$1; shift
+ local dev0=$1; shift
+ local dev1=$1; shift
+
+ local c0 c1
+ c0=$(tc_filter_pkt_count "$ns" "$dev0")
+ c1=$(tc_filter_pkt_count "$ns" "$dev1")
+ [ "${c0:-0}" -ge 1 ] && [ "${c1:-0}" -ge 1 ]
+}
+
+link_tx_packets_total()
+{
+ local ns=$1; shift
+
+ echo $(( $(link_tx_packets_get "$ns" veth0a) +
+ $(link_tx_packets_get "$ns" veth1a) ))
+}
+
+setup()
+{
+ setup_ns NS1 NS2
+
+ local ns
+ for ns in "$NS1" "$NS2"; do
+ ip netns exec "$ns" sysctl -qw net.ipv6.conf.all.accept_dad=0
+ ip netns exec "$ns" sysctl -qw net.ipv6.conf.default.accept_dad=0
+ ip netns exec "$ns" sysctl -qw net.ipv6.conf.all.forwarding=1
+ ip netns exec "$ns" sysctl -qw net.core.txrehash=1
+ done
+
+ local i sub
+ for i in 0 1; do
+ sub=${SUBNETS[$i]}
+ ip link add "veth${i}a" type veth peer name "veth${i}b"
+ ip link set "veth${i}a" netns "$NS1"
+ ip link set "veth${i}b" netns "$NS2"
+ ip -n "$NS1" addr add "fd00:${sub}::1/64" dev "veth${i}a"
+ ip -n "$NS2" addr add "fd00:${sub}::2/64" dev "veth${i}b"
+ ip -n "$NS1" link set "veth${i}a" up
+ ip -n "$NS2" link set "veth${i}b" up
+ done
+
+ ip -n "$NS1" addr add fd00:ff::1/128 dev lo
+ ip -n "$NS2" addr add fd00:ff::2/128 dev lo
+
+ # Allow many SYN retries at 1-second intervals (linear, no
+ # exponential backoff) so the rehash test has enough attempts
+ # to exercise both ECMP paths.
+ if ! ip netns exec "$NS1" sysctl -qw \
+ net.ipv4.tcp_syn_linear_timeouts=25; then
+ echo "SKIP: tcp_syn_linear_timeouts not supported"
+ return "$ksft_skip"
+ fi
+ ip netns exec "$NS1" sysctl -qw net.ipv4.tcp_syn_retries=25
+
+ # Keep the server's request socket alive during the blocking
+ # period so SYN/ACK retransmits continue.
+ ip netns exec "$NS2" sysctl -qw net.ipv4.tcp_synack_retries=25
+
+ ip -n "$NS1" -6 route add fd00:ff::2/128 \
+ nexthop via fd00:a::2 dev veth0a \
+ nexthop via fd00:b::2 dev veth1a
+
+ ip -n "$NS2" -6 route add fd00:ff::1/128 \
+ nexthop via fd00:a::1 dev veth0b \
+ nexthop via fd00:b::1 dev veth1b
+
+ for i in 0 1; do
+ sub=${SUBNETS[$i]}
+ ip netns exec "$NS1" \
+ ping -6 -c1 -W5 "fd00:${sub}::2" &>/dev/null
+ ip netns exec "$NS2" \
+ ping -6 -c1 -W5 "fd00:${sub}::1" &>/dev/null
+ done
+
+ if ! ip netns exec "$NS1" ping -6 -c1 -W5 fd00:ff::2 &>/dev/null; then
+ echo "Basic connectivity check failed"
+ return "$ksft_skip"
+ fi
+}
+
+# Block ALL paths, start a connection, wait until SYNs have been dropped
+# on both interfaces (proving rehash steered the SYN to a new path), then
+# unblock so the connection completes.
+test_ecmp_syn_rehash()
+{
+ RET=0
+
+ block_tcp "$NS1" veth0a
+ defer unblock_tcp "$NS1" veth0a
+ block_tcp "$NS1" veth1a
+ defer unblock_tcp "$NS1" veth1a
+
+ ip netns exec "$NS2" socat \
+ "TCP6-LISTEN:$PORT,bind=[fd00:ff::2],reuseaddr,fork" \
+ EXEC:"echo ESTABLISH_OK" &
+ defer kill_process $!
+
+ wait_local_port_listen "$NS2" "$PORT" tcp
+
+ local rehash_before
+ rehash_before=$(get_netstat_counter "$NS1" TcpTimeoutRehash)
+
+ # Start the connection in the background; it will retry SYNs at
+ # 1-second intervals until an unblocked path is found.
+ # Use -u (unidirectional) to only receive from the server;
+ # sending data back would risk SIGPIPE if the server's EXEC
+ # child has already exited.
+ local tmpfile
+ tmpfile=$(mktemp)
+ defer rm -f "$tmpfile"
+
+ ip netns exec "$NS1" socat -u \
+ "TCP6:[fd00:ff::2]:$PORT,bind=[fd00:ff::1],connect-timeout=60" \
+ STDOUT >"$tmpfile" 2>&1 &
+ local client_pid=$!
+ defer kill_process "$client_pid"
+
+ # Wait until both paths have seen at least one dropped SYN.
+ # This proves sk_rethink_txhash() rehashed the connection from
+ # one ECMP path to the other.
+ slowwait 30 both_devs_attempted "$NS1" veth0a veth1a
+ check_err $? "SYNs did not appear on both paths (rehash not working)"
+ if [ "$RET" -ne 0 ]; then
+ log_test "Local ECMP SYN rehash: establish with blocked paths"
+ return
+ fi
+
+ # Unblock both paths and let the next SYN retransmit succeed.
+ unblock_tcp "$NS1" veth0a
+ unblock_tcp "$NS1" veth1a
+
+ local rc=0
+ wait "$client_pid" || rc=$?
+
+ local result
+ result=$(cat "$tmpfile" 2>/dev/null)
+
+ if [[ "$result" != *"ESTABLISH_OK"* ]]; then
+ check_err 1 "connection failed after unblocking (rc=$rc): $result"
+ fi
+
+ local rehash_after
+ rehash_after=$(get_netstat_counter "$NS1" TcpTimeoutRehash)
+ if [ "$rehash_after" -le "$rehash_before" ]; then
+ check_err 1 "TcpTimeoutRehash counter did not increment"
+ fi
+
+ log_test "Local ECMP SYN rehash: establish with blocked paths"
+}
+
+# Block the server's return paths so SYN/ACKs are dropped. The client
+# retransmits SYNs at 1-second intervals; each duplicate SYN arriving at
+# the server triggers tcp_rtx_synack() which re-rolls txhash, so the
+# retransmitted SYN/ACK selects a different ECMP return path.
+test_ecmp_synack_rehash()
+{
+ RET=0
+ local port=$((PORT + 2))
+
+ block_tcp "$NS2" veth0b
+ defer unblock_tcp "$NS2" veth0b
+ block_tcp "$NS2" veth1b
+ defer unblock_tcp "$NS2" veth1b
+
+ ip netns exec "$NS2" socat \
+ "TCP6-LISTEN:$port,bind=[fd00:ff::2],reuseaddr,fork" \
+ EXEC:"echo SYNACK_OK" &
+ defer kill_process $!
+
+ wait_local_port_listen "$NS2" "$port" tcp
+
+ # Start the connection; SYNs reach the server (client egress is
+ # open) but SYN/ACKs are dropped on the server's return path.
+ local tmpfile
+ tmpfile=$(mktemp)
+ defer rm -f "$tmpfile"
+
+ ip netns exec "$NS1" socat -u \
+ "TCP6:[fd00:ff::2]:$port,bind=[fd00:ff::1],connect-timeout=60" \
+ STDOUT >"$tmpfile" 2>&1 &
+ local client_pid=$!
+ defer kill_process "$client_pid"
+
+ # Wait until both server-side interfaces have dropped at least
+ # one SYN/ACK, proving the server rehashed its return path.
+ slowwait 30 both_devs_attempted "$NS2" veth0b veth1b
+ check_err $? "SYN/ACKs did not appear on both return paths"
+ if [ "$RET" -ne 0 ]; then
+ log_test "Local ECMP SYN/ACK rehash: blocked return path"
+ return
+ fi
+
+ # Unblock and let the connection complete.
+ unblock_tcp "$NS2" veth0b
+ unblock_tcp "$NS2" veth1b
+
+ local rc=0
+ wait "$client_pid" || rc=$?
+
+ local result
+ result=$(cat "$tmpfile" 2>/dev/null)
+
+ if [[ "$result" != *"SYNACK_OK"* ]]; then
+ check_err 1 "connection failed after unblocking (rc=$rc): $result"
+ fi
+
+ log_test "Local ECMP SYN/ACK rehash: blocked return path"
+}
+
+# Establish a data transfer with both paths open, then block the
+# active path. Verify that data appears on the previously inactive
+# path (proving RTO triggered a rehash) and that TcpTimeoutRehash
+# incremented.
+#
+# With 2-way ECMP each rehash may pick the same path, so a single
+# attempt can occasionally fail. Retry once for robustness.
+
+# Single attempt at the midstream rehash check. Returns 0 on success.
+ecmp_midstream_rehash_attempt()
+{
+ local port=$1; shift
+
+ ip netns exec "$NS2" socat -u \
+ "TCP6-LISTEN:$port,bind=[fd00:ff::2],reuseaddr" - >/dev/null &
+ local server_pid=$!
+
+ wait_local_port_listen "$NS2" "$port" tcp
+
+ local base_tx0 base_tx1
+ base_tx0=$(link_tx_packets_get "$NS1" veth0a)
+ base_tx1=$(link_tx_packets_get "$NS1" veth1a)
+
+ # Continuous data source; timeout caps overall test duration and
+ # must exceed the slowwait below so data keeps flowing.
+ ip netns exec "$NS1" timeout 90 socat -u \
+ OPEN:/dev/zero \
+ "TCP6:[fd00:ff::2]:$port,bind=[fd00:ff::1]" &>/dev/null &
+ local client_pid=$!
+
+ # Wait for enough packets to identify the active path.
+ if ! busywait "$BUSYWAIT_TIMEOUT" until_counter_is \
+ ">= $((base_tx0 + base_tx1 + 10))" \
+ link_tx_packets_total "$NS1" > /dev/null; then
+ kill "$client_pid" "$server_pid" 2>/dev/null
+ wait "$client_pid" "$server_pid" 2>/dev/null
+ return 1
+ fi
+
+ # Find the active path and block it.
+ local current_tx0 current_tx1 active_idx inactive_idx
+ current_tx0=$(link_tx_packets_get "$NS1" veth0a)
+ current_tx1=$(link_tx_packets_get "$NS1" veth1a)
+ if [ $((current_tx0 - base_tx0)) -ge $((current_tx1 - base_tx1)) ]; then
+ active_idx=0; inactive_idx=1
+ else
+ active_idx=1; inactive_idx=0
+ fi
+
+ local rehash_before
+ rehash_before=$(get_netstat_counter "$NS1" TcpTimeoutRehash)
+ # Suppress __dst_negative_advice() in tcp_write_timeout() so
+ # that __sk_dst_reset() is the only dst-invalidation mechanism
+ # on the RTO path.
+ local saved_retries1
+ saved_retries1=$(ip netns exec "$NS1" sysctl -n net.ipv4.tcp_retries1)
+ ip netns exec "$NS1" sysctl -qw net.ipv4.tcp_retries1=255
+
+ block_tcp "$NS1" "veth${active_idx}a"
+
+ # Capture baseline after block_tcp returns. block_tcp adds a
+ # prio qdisc then a tc filter; between those two steps the
+ # qdisc's CAN_BYPASS fast-path lets packets through unfiltered.
+ local inactive_before
+ inactive_before=$(link_tx_packets_get "$NS1" "veth${inactive_idx}a")
+
+ # Wait for meaningful data on the previously inactive path,
+ # proving RTO triggered a rehash and data actually moved.
+ local rc=0
+ if ! slowwait 60 dev_tx_packets_above \
+ "$NS1" "veth${inactive_idx}a" "$((inactive_before + 100))"; then
+ rc=1
+ fi
+
+ local rehash_after
+ rehash_after=$(get_netstat_counter "$NS1" TcpTimeoutRehash)
+ if [ "$rehash_after" -le "$rehash_before" ]; then
+ rc=1
+ fi
+
+ unblock_tcp "$NS1" "veth${active_idx}a"
+ ip netns exec "$NS1" sysctl -qw \
+ net.ipv4.tcp_retries1="$saved_retries1"
+ kill "$client_pid" "$server_pid" 2>/dev/null
+ wait "$client_pid" "$server_pid" 2>/dev/null
+ return "$rc"
+}
+
+test_ecmp_midstream_rehash()
+{
+ RET=0
+ local port=$((PORT + 1))
+
+ if ! ecmp_midstream_rehash_attempt "$port"; then
+ ecmp_midstream_rehash_attempt "$((port + 1))"
+ check_err $? "data did not appear on alternate path after blocking"
+ fi
+
+ log_test "Local ECMP midstream rehash: block active path"
+}
+
+# Single attempt at the ACK rehash check. Returns 0 on success.
+ecmp_ack_rehash_attempt()
+{
+ local port=$1; shift
+
+ ip netns exec "$NS2" socat -u \
+ "TCP6-LISTEN:$port,bind=[fd00:ff::2],reuseaddr" - >/dev/null &
+ local server_pid=$!
+
+ wait_local_port_listen "$NS2" "$port" tcp
+
+ local base_total
+ base_total=$(link_tx_packets_total "$NS1")
+
+ # Continuous data source from NS1 to NS2.
+ ip netns exec "$NS1" timeout 120 socat -u \
+ OPEN:/dev/zero \
+ "TCP6:[fd00:ff::2]:$port,bind=[fd00:ff::1]" &>/dev/null &
+ local client_pid=$!
+
+ # Wait for data to start flowing.
+ if ! busywait "$BUSYWAIT_TIMEOUT" until_counter_is \
+ ">= $((base_total + 10))" \
+ link_tx_packets_total "$NS1" > /dev/null; then
+ kill "$client_pid" "$server_pid" 2>/dev/null
+ wait "$client_pid" "$server_pid" 2>/dev/null
+ return 1
+ fi
+
+ local rehash_before
+ rehash_before=$(get_netstat_counter "$NS2" TcpDuplicateDataRehash)
+
+ # Block both return paths from NS2 so ACKs are dropped.
+ # Data from NS1 still arrives (tc filter is on egress).
+ block_tcp "$NS2" veth0b
+ block_tcp "$NS2" veth1b
+
+ # NS1 will RTO (no ACKs), retransmit with new flowlabel.
+ # NS2 detects the flowlabel change via tcp_rcv_spurious_retrans(),
+ # rehashes, and NS2's ACKs try a different ECMP return path.
+ # Wait until both NS2 interfaces have dropped at least one ACK.
+ local rc=0
+ if ! slowwait 60 both_devs_attempted "$NS2" veth0b veth1b; then
+ rc=1
+ fi
+
+ local rehash_after
+ rehash_after=$(get_netstat_counter "$NS2" TcpDuplicateDataRehash)
+ if [ "$rehash_after" -le "$rehash_before" ]; then
+ rc=1
+ fi
+
+ unblock_tcp "$NS2" veth0b
+ unblock_tcp "$NS2" veth1b
+ kill "$client_pid" "$server_pid" 2>/dev/null
+ wait "$client_pid" "$server_pid" 2>/dev/null
+ return "$rc"
+}
+
+# Block the receiver's (NS2) ACK return paths while data flows from
+# NS1 to NS2. The sender (NS1) times out and retransmits with a new
+# flowlabel; the receiver detects the changed flowlabel via
+# tcp_rcv_spurious_retrans() and rehashes its own txhash so that its
+# ACKs try a different ECMP return path.
+#
+# With 2-way ECMP each rehash may pick the same path, so a single
+# attempt can occasionally fail. Retry once for robustness.
+test_ecmp_midstream_ack_rehash()
+{
+ RET=0
+ local port=$((PORT + 3))
+
+ if ! ecmp_ack_rehash_attempt "$port"; then
+ ecmp_ack_rehash_attempt "$((port + 1))"
+ check_err $? "ACKs did not appear on both return paths"
+ fi
+
+ log_test "Local ECMP midstream ACK rehash: blocked return path"
+}
+
+# Establish a DCTCP data transfer with PLB enabled, then ECN-mark both
+# paths. Sustained CE marking triggers PLB to call sk_rethink_txhash()
+# + __sk_dst_reset(), bouncing the connection between ECMP paths.
+# Verify data appears on both paths and that TCPPLBRehash incremented.
+test_ecmp_plb_rehash()
+{
+ RET=0
+ local port=$((PORT + 4))
+
+ # DCTCP is a restricted congestion control algorithm. Add it to
+ # tcp_allowed_congestion_control to mark it TCP_CONG_NON_RESTRICTED
+ # so test namespaces can set it as their default. This avoids
+ # changing the host's default congestion control algorithm.
+ # The write must be from the root namespace; writes from child
+ # namespaces do not take effect.
+ local saved_allowed
+ saved_allowed=$(sysctl -n net.ipv4.tcp_allowed_congestion_control)
+ if ! echo "$saved_allowed" | grep -qw dctcp; then
+ local was_loaded
+ was_loaded=$(grep -cw tcp_dctcp /proc/modules 2>/dev/null)
+ modprobe tcp_dctcp 2>/dev/null
+ # Unload only if we loaded it (absent before, present now).
+ # Built-in modules never appear in /proc/modules.
+ if [ "${was_loaded:-0}" -eq 0 ] &&
+ grep -qw tcp_dctcp /proc/modules 2>/dev/null; then
+ defer modprobe -r tcp_dctcp 2>/dev/null
+ fi
+ if ! sysctl -qw net.ipv4.tcp_allowed_congestion_control="$saved_allowed dctcp"; then
+ log_test_skip "Local ECMP PLB rehash: DCTCP not available"
+ return "$ksft_skip"
+ fi
+ defer sysctl -qw \
+ net.ipv4.tcp_allowed_congestion_control="$saved_allowed"
+ fi
+
+ # Save NS1 sysctls before modifying them.
+ local saved_ecn1 saved_cc1 saved_plb_enabled saved_plb_rounds
+ local saved_plb_thresh saved_plb_suspend
+ saved_ecn1=$(ip netns exec "$NS1" sysctl -n net.ipv4.tcp_ecn)
+ saved_cc1=$(ip netns exec "$NS1" sysctl -n net.ipv4.tcp_congestion_control)
+ saved_plb_enabled=$(ip netns exec "$NS1" sysctl -n net.ipv4.tcp_plb_enabled)
+ saved_plb_rounds=$(ip netns exec "$NS1" sysctl -n net.ipv4.tcp_plb_rehash_rounds)
+ saved_plb_thresh=$(ip netns exec "$NS1" sysctl -n net.ipv4.tcp_plb_cong_thresh)
+ saved_plb_suspend=$(ip netns exec "$NS1" sysctl -n net.ipv4.tcp_plb_suspend_rto_sec)
+
+ # Enable ECN and DCTCP with PLB on the sender.
+ ip netns exec "$NS1" sysctl -qw net.ipv4.tcp_ecn=1
+ ip netns exec "$NS1" sysctl -qw net.ipv4.tcp_congestion_control=dctcp
+ ip netns exec "$NS1" sysctl -qw net.ipv4.tcp_plb_enabled=1
+ ip netns exec "$NS1" sysctl -qw net.ipv4.tcp_plb_rehash_rounds=3
+ ip netns exec "$NS1" sysctl -qw net.ipv4.tcp_plb_cong_thresh=1
+ ip netns exec "$NS1" sysctl -qw net.ipv4.tcp_plb_suspend_rto_sec=0
+ defer ip netns exec "$NS1" sysctl -qw net.ipv4.tcp_ecn="$saved_ecn1"
+ defer ip netns exec "$NS1" sysctl -qw net.ipv4.tcp_congestion_control="$saved_cc1"
+ defer ip netns exec "$NS1" sysctl -qw net.ipv4.tcp_plb_enabled="$saved_plb_enabled"
+ defer ip netns exec "$NS1" sysctl -qw net.ipv4.tcp_plb_rehash_rounds="$saved_plb_rounds"
+ defer ip netns exec "$NS1" sysctl -qw net.ipv4.tcp_plb_cong_thresh="$saved_plb_thresh"
+ defer ip netns exec "$NS1" sysctl -qw net.ipv4.tcp_plb_suspend_rto_sec="$saved_plb_suspend"
+
+ # DCTCP sets ECT on the SYN; the receiver must also use DCTCP
+ # so that tcp_ca_needs_ecn(listen_sk) accepts the ECN
+ # negotiation.
+ local saved_ecn2 saved_cc2
+ saved_ecn2=$(ip netns exec "$NS2" sysctl -n net.ipv4.tcp_ecn)
+ saved_cc2=$(ip netns exec "$NS2" sysctl -n net.ipv4.tcp_congestion_control)
+ ip netns exec "$NS2" sysctl -qw net.ipv4.tcp_ecn=1
+ ip netns exec "$NS2" sysctl -qw net.ipv4.tcp_congestion_control=dctcp
+ defer ip netns exec "$NS2" sysctl -qw net.ipv4.tcp_ecn="$saved_ecn2"
+ defer ip netns exec "$NS2" sysctl -qw net.ipv4.tcp_congestion_control="$saved_cc2"
+
+ ip netns exec "$NS2" socat -u \
+ "TCP6-LISTEN:$port,bind=[fd00:ff::2],reuseaddr" - >/dev/null &
+ defer kill_process $!
+
+ wait_local_port_listen "$NS2" "$port" tcp
+
+ local base_tx0 base_tx1
+ base_tx0=$(link_tx_packets_get "$NS1" veth0a)
+ base_tx1=$(link_tx_packets_get "$NS1" veth1a)
+
+ ip netns exec "$NS1" timeout 90 socat -u \
+ OPEN:/dev/zero \
+ "TCP6:[fd00:ff::2]:$port,bind=[fd00:ff::1]" &>/dev/null &
+ local client_pid=$!
+ defer kill_process "$client_pid"
+
+ # Wait for data to start flowing before applying ECN marking.
+ busywait "$BUSYWAIT_TIMEOUT" until_counter_is \
+ ">= $((base_tx0 + base_tx1 + 10))" \
+ link_tx_packets_total "$NS1" > /dev/null
+ check_err $? "no TX activity detected"
+ if [ "$RET" -ne 0 ]; then
+ log_test "Local ECMP PLB rehash: ECN-marked path"
+ return
+ fi
+
+ # Snapshot TX counters and rehash stats before ECN marking.
+ local pre_ecn_tx0 pre_ecn_tx1
+ pre_ecn_tx0=$(link_tx_packets_get "$NS1" veth0a)
+ pre_ecn_tx1=$(link_tx_packets_get "$NS1" veth1a)
+
+ local plb_before rto_before
+ plb_before=$(get_netstat_counter "$NS1" TCPPLBRehash)
+ rto_before=$(get_netstat_counter "$NS1" TcpTimeoutRehash)
+
+ # CE-mark all data on both paths. PLB detects sustained
+ # congestion and rehashes, bouncing traffic between paths.
+ mark_ecn "$NS1" veth0a
+ defer unblock_tcp "$NS1" veth0a # removes the marking rule
+ mark_ecn "$NS1" veth1a
+ defer unblock_tcp "$NS1" veth1a # removes the marking rule
+
+ # Wait for meaningful data on both paths, proving PLB rehashed
+ # the connection and traffic actually moved. Require at least
+ # 100 packets beyond the baseline to rule out stray control
+ # packets (ND, etc.) satisfying the check.
+ slowwait 60 dev_tx_packets_above \
+ "$NS1" veth0a "$((pre_ecn_tx0 + 100))"
+ check_err $? "no data on veth0a after ECN marking"
+
+ slowwait 60 dev_tx_packets_above \
+ "$NS1" veth1a "$((pre_ecn_tx1 + 100))"
+ check_err $? "no data on veth1a after ECN marking"
+
+ local plb_after rto_after
+ plb_after=$(get_netstat_counter "$NS1" TCPPLBRehash)
+ rto_after=$(get_netstat_counter "$NS1" TcpTimeoutRehash)
+ if [ "$plb_after" -le "$plb_before" ]; then
+ check_err 1 "TCPPLBRehash counter did not increment"
+ fi
+ if [ "$rto_after" -gt "$rto_before" ]; then
+ check_err 1 "TcpTimeoutRehash incremented; rehash was RTO-driven, not PLB"
+ fi
+
+ log_test "Local ECMP PLB rehash: ECN-marked path"
+}
+
+# Verify that hash policy 1 (L3+L4 symmetric) preserves the ECMP path
+# across rehash. Policy 1 computes a deterministic hash from the
+# 5-tuple, so mp_hash stays 0 and rt6_multipath_hash() always selects
+# the same path regardless of txhash changes.
+test_ecmp_hash_policy1_no_rehash()
+{
+ RET=0
+ local port=$((PORT + 5))
+
+ local saved_policy
+ saved_policy=$(ip netns exec "$NS1" sysctl -n \
+ net.ipv6.fib_multipath_hash_policy)
+ ip netns exec "$NS1" sysctl -qw net.ipv6.fib_multipath_hash_policy=1
+ defer ip netns exec "$NS1" sysctl -qw \
+ net.ipv6.fib_multipath_hash_policy="$saved_policy"
+
+ block_tcp "$NS1" veth0a
+ defer unblock_tcp "$NS1" veth0a
+ block_tcp "$NS1" veth1a
+ defer unblock_tcp "$NS1" veth1a
+
+ ip netns exec "$NS2" socat \
+ "TCP6-LISTEN:$port,bind=[fd00:ff::2],reuseaddr,fork" \
+ EXEC:"echo POLICY1_OK" &
+ defer kill_process $!
+
+ wait_local_port_listen "$NS2" "$port" tcp
+
+ local rehash_before
+ rehash_before=$(get_netstat_counter "$NS1" TcpTimeoutRehash)
+
+ ip netns exec "$NS1" timeout 10 socat -u \
+ "TCP6:[fd00:ff::2]:$port,bind=[fd00:ff::1],connect-timeout=8" \
+ STDOUT >/dev/null 2>&1 &
+ local client_pid=$!
+ defer kill_process "$client_pid"
+
+ # With policy 1, the deterministic 5-tuple hash always selects
+ # the same path. Wait for multiple SYN retransmits (proving
+ # rehash was attempted), then verify all SYNs landed on the
+ # same interface.
+ local rehash_after
+ slowwait 8 until_counter_is ">= $((rehash_before + 3))" \
+ get_netstat_counter "$NS1" TcpTimeoutRehash > /dev/null
+ rehash_after=$(get_netstat_counter "$NS1" TcpTimeoutRehash)
+ if [ "$rehash_after" -le "$rehash_before" ]; then
+ check_err 1 "TcpTimeoutRehash counter did not increment"
+ fi
+
+ local c0 c1
+ c0=$(tc_filter_pkt_count "$NS1" veth0a)
+ c1=$(tc_filter_pkt_count "$NS1" veth1a)
+ if [ "${c0:-0}" -ge 1 ] && [ "${c1:-0}" -ge 1 ]; then
+ check_err 1 "SYNs appeared on both paths despite policy 1"
+ fi
+ if [ "${c0:-0}" -eq 0 ] && [ "${c1:-0}" -eq 0 ]; then
+ check_err 1 "no SYNs observed on either path"
+ fi
+
+ log_test "Local ECMP policy 1: no path change on rehash"
+}
+
+# Verify that mp_hash does not leak into the on-wire flowlabel.
+# With auto_flowlabels=0, the wire flowlabel must be 0. Install tc
+# filters that pass TCP with flowlabel=0 but drop TCP with nonzero
+# flowlabel, then establish a connection and transfer data. If
+# mp_hash leaked into fl6->flowlabel, the SYN or data packets would
+# be dropped and the connection would fail.
+test_ecmp_no_flowlabel_leak()
+{
+ RET=0
+ local port=$((PORT + 6))
+
+ local saved_afl
+ saved_afl=$(ip netns exec "$NS1" sysctl -n \
+ net.ipv6.auto_flowlabels)
+ ip netns exec "$NS1" sysctl -qw net.ipv6.auto_flowlabels=0
+ defer ip netns exec "$NS1" sysctl -qw \
+ net.ipv6.auto_flowlabels="$saved_afl"
+
+ # On both egress interfaces: pass TCP with flowlabel=0 (prio 1),
+ # drop any remaining TCP (nonzero flowlabel, prio 2). ICMPv6
+ # matches neither filter and passes through normally.
+ local dev
+ for dev in veth0a veth1a; do
+ ip netns exec "$NS1" tc qdisc add dev "$dev" \
+ root handle 1: prio
+ ip netns exec "$NS1" tc filter add dev "$dev" parent 1: \
+ protocol ipv6 prio 1 u32 \
+ match u32 0x00000000 0x000FFFFF at 0 \
+ match u8 0x06 0xff at 6 \
+ action ok
+ ip netns exec "$NS1" tc filter add dev "$dev" parent 1: \
+ protocol ipv6 prio 2 u32 \
+ match u8 0x06 0xff at 6 \
+ action drop
+ defer unblock_tcp "$NS1" "$dev"
+ done
+
+ ip netns exec "$NS2" socat \
+ "TCP6-LISTEN:$port,bind=[fd00:ff::2],reuseaddr" \
+ EXEC:"echo FLOWLABEL_OK" &
+ defer kill_process $!
+
+ wait_local_port_listen "$NS2" "$port" tcp
+
+ local tmpfile
+ tmpfile=$(mktemp)
+ defer rm -f "$tmpfile"
+
+ ip netns exec "$NS1" socat -u \
+ "TCP6:[fd00:ff::2]:$port,bind=[fd00:ff::1],connect-timeout=10" \
+ STDOUT >"$tmpfile" 2>&1
+
+ local result
+ result=$(cat "$tmpfile" 2>/dev/null)
+ if [[ "$result" != *"FLOWLABEL_OK"* ]]; then
+ check_err 1 "connection failed: mp_hash may have leaked into wire flowlabel"
+ fi
+
+ log_test "No flowlabel leak with auto_flowlabels=0"
+}
+
+# Helper: stream data, invalidate the cached dst by adding and
+# removing a dummy route (bumps fib6_node sernum), then check that
+# traffic stays on the same ECMP path. Used by both the normal
+# tcp_v6_connect and syncookie variants.
+ecmp_dst_rebuild_check()
+{
+ local ns_client=$1; shift
+ local ns_server=$1; shift
+ local port=$1; shift
+ local rc=0
+
+ # Suppress __dst_negative_advice() during the test so that a
+ # real TCP timeout cannot trigger an additional dst
+ # invalidation via a different code path.
+ local saved_retries1
+ saved_retries1=$(ip netns exec "$ns_client" sysctl -n \
+ net.ipv4.tcp_retries1)
+ ip netns exec "$ns_client" sysctl -qw net.ipv4.tcp_retries1=255
+
+ local base0 base1
+ base0=$(link_tx_packets_get "$ns_client" veth0a)
+ base1=$(link_tx_packets_get "$ns_client" veth1a)
+
+ ip netns exec "$ns_client" timeout 15 socat -u \
+ OPEN:/dev/zero \
+ "TCP6:[fd00:ff::2]:$port,bind=[fd00:ff::1]" \
+ &>/dev/null &
+ local client_pid=$!
+
+ # Wait for enough packets to identify the active path.
+ # Return 2 for setup failure (distinct from 1 = path changed).
+ if ! busywait "$BUSYWAIT_TIMEOUT" until_counter_is \
+ ">= $((base0 + base1 + 50))" \
+ link_tx_packets_total "$ns_client" > /dev/null; then
+ ip netns exec "$ns_client" sysctl -qw \
+ net.ipv4.tcp_retries1="$saved_retries1"
+ kill "$client_pid" 2>/dev/null
+ wait "$client_pid" 2>/dev/null
+ return 2
+ fi
+
+ local mid0 mid1 active_dev inactive_dev
+ mid0=$(link_tx_packets_get "$ns_client" veth0a)
+ mid1=$(link_tx_packets_get "$ns_client" veth1a)
+ if [ $((mid0 - base0)) -ge $((mid1 - base1)) ]; then
+ active_dev=veth0a; inactive_dev=veth1a
+ else
+ active_dev=veth1a; inactive_dev=veth0a
+ fi
+
+ local active_before inactive_before
+ active_before=$(link_tx_packets_get "$ns_client" "$active_dev")
+ inactive_before=$(link_tx_packets_get "$ns_client" "$inactive_dev")
+
+ # Invalidate the cached dst by bumping the fib6_node sernum.
+ # Adding and removing a high-metric dummy route achieves this
+ # without touching the ECMP nexthops, avoiding a transient
+ # single-nexthop state during multipath route replace.
+ ip -n "$ns_client" -6 route add fd00:ff::2/128 dev lo metric 9999
+ ip -n "$ns_client" -6 route del fd00:ff::2/128 dev lo metric 9999
+
+ # Wait for enough post-rebuild traffic to detect a path change.
+ if ! busywait "$BUSYWAIT_TIMEOUT" until_counter_is \
+ ">= $((active_before + inactive_before + 50))" \
+ link_tx_packets_total "$ns_client" > /dev/null; then
+ ip netns exec "$ns_client" sysctl -qw \
+ net.ipv4.tcp_retries1="$saved_retries1"
+ kill "$client_pid" 2>/dev/null
+ wait "$client_pid" 2>/dev/null
+ return 2
+ fi
+
+ local active_after inactive_after
+ active_after=$(link_tx_packets_get "$ns_client" "$active_dev")
+ inactive_after=$(link_tx_packets_get "$ns_client" "$inactive_dev")
+
+ local active_delta=$((active_after - active_before))
+ local inactive_delta=$((inactive_after - inactive_before))
+
+ if [ "$inactive_delta" -gt "$active_delta" ]; then
+ rc=1
+ fi
+
+ ip netns exec "$ns_client" sysctl -qw \
+ net.ipv4.tcp_retries1="$saved_retries1"
+ kill "$client_pid" 2>/dev/null
+ wait "$client_pid" 2>/dev/null
+ return "$rc"
+}
+
+# Run ecmp_dst_rebuild_check for ECMP_REBUILD_ROUNDS rounds, each with
+# a fresh server and connection. With a correct kernel the path is
+# deterministic (same txhash always selects the same ECMP nexthop),
+# so any path change is a bug. Multiple rounds catch a buggy kernel
+# that picks a random path: each round has 50% chance of accidentally
+# matching, so 10 rounds gives < 0.1% false-pass probability.
+ecmp_dst_rebuild_loop()
+{
+ local base_port=$1; shift
+ local label=$1; shift
+ local path_changes=0
+ local r
+
+ for r in $(seq 1 "$ECMP_REBUILD_ROUNDS"); do
+ local port=$((base_port + r))
+
+ ip netns exec "$NS2" socat -u \
+ "TCP6-LISTEN:$port,bind=[fd00:ff::2],reuseaddr" \
+ - >/dev/null &
+ local server_pid=$!
+
+ wait_local_port_listen "$NS2" "$port" tcp
+
+ local check_rc=0
+ ecmp_dst_rebuild_check "$NS1" "$NS2" "$port" || check_rc=$?
+ if [ "$check_rc" -eq 2 ]; then
+ check_err 1 "no TX activity in round $r"
+ break
+ elif [ "$check_rc" -eq 1 ]; then
+ path_changes=$((path_changes + 1))
+ fi
+
+ kill "$server_pid" 2>/dev/null
+ wait "$server_pid" 2>/dev/null
+ done
+
+ if [ "$path_changes" -gt 0 ]; then
+ check_err 1 "$path_changes/$ECMP_REBUILD_ROUNDS changed path"
+ fi
+
+ log_test "$label"
+}
+
+# Verify that a dst invalidation does not cause the connection to
+# switch ECMP paths. With the fix, both the initial route lookup
+# (tcp_v6_connect) and subsequent rebuilds (inet6_csk_route_socket)
+# use sk_txhash >> 1, so the path is stable.
+test_ecmp_dst_rebuild_consistency()
+{
+ RET=0
+
+ ecmp_dst_rebuild_loop "$((PORT + 7))" \
+ "ECMP path stable after dst invalidation"
+}
+
+# Same as above but with syncookies forced (tcp_syncookies=2), so the
+# server creates the full socket via cookie_v6_check() instead of the
+# normal three-way handshake path.
+test_ecmp_dst_rebuild_syncookie_consistency()
+{
+ RET=0
+
+ local saved_syncookies
+ saved_syncookies=$(ip netns exec "$NS2" sysctl -n \
+ net.ipv4.tcp_syncookies)
+ ip netns exec "$NS2" sysctl -qw net.ipv4.tcp_syncookies=2
+ defer ip netns exec "$NS2" sysctl -qw \
+ net.ipv4.tcp_syncookies="$saved_syncookies"
+
+ ecmp_dst_rebuild_loop "$((PORT + 27))" \
+ "ECMP path stable after dst invalidation (syncookies)"
+}
+
+# Verify that the server's SYN-ACK (sent from the request socket) and
+# subsequent ACKs (sent from the full socket created in cookie_v6_check)
+# use the same ECMP path. With syncookies the request socket is freed
+# after the SYN-ACK and a new one is created during cookie validation;
+# this test catches the case where the two request sockets pick
+# different ECMP paths due to independent txhash values.
+# Count TCP packets on server egress without blocking them.
+# Uses tc filters with "action ok" so packets are counted and passed.
+count_tcp()
+{
+ local ns=$1; shift
+ local dev=$1; shift
+
+ ip netns exec "$ns" tc qdisc add dev "$dev" root handle 1: prio
+ ip netns exec "$ns" tc filter add dev "$dev" parent 1: \
+ protocol ipv6 prio 1 u32 match u8 0x06 0xff at 6 action ok
+}
+
+test_ecmp_syncookie_path_consistency()
+{
+ RET=0
+
+ local saved_syncookies
+ saved_syncookies=$(ip netns exec "$NS2" sysctl -n \
+ net.ipv4.tcp_syncookies)
+ ip netns exec "$NS2" sysctl -qw net.ipv4.tcp_syncookies=2
+ defer ip netns exec "$NS2" sysctl -qw \
+ net.ipv4.tcp_syncookies="$saved_syncookies"
+
+ count_tcp "$NS2" veth0b
+ defer unblock_tcp "$NS2" veth0b
+ count_tcp "$NS2" veth1b
+ defer unblock_tcp "$NS2" veth1b
+
+ local path_splits=0
+ local r
+
+ for r in $(seq 1 "$ECMP_REBUILD_ROUNDS"); do
+ local port=$((PORT + 47 + r))
+
+ ip netns exec "$NS2" socat -u \
+ "TCP6-LISTEN:$port,bind=[fd00:ff::2],reuseaddr" \
+ - >/dev/null &
+ local server_pid=$!
+
+ wait_local_port_listen "$NS2" "$port" tcp
+
+ local srv_base0 srv_base1
+ srv_base0=$(tc_filter_pkt_count "$NS2" veth0b)
+ srv_base1=$(tc_filter_pkt_count "$NS2" veth1b)
+
+ ip netns exec "$NS1" timeout 5 socat -u \
+ OPEN:/dev/zero \
+ "TCP6:[fd00:ff::2]:$port,bind=[fd00:ff::1]" \
+ &>/dev/null &
+ local client_pid=$!
+
+ local cli_base
+ cli_base=$(link_tx_packets_total "$NS1")
+ if ! busywait "$BUSYWAIT_TIMEOUT" until_counter_is \
+ ">= $((cli_base + 200))" \
+ link_tx_packets_total "$NS1" > /dev/null; then
+ check_err 1 "no TX activity in round $r"
+ kill "$client_pid" 2>/dev/null
+ wait "$client_pid" 2>/dev/null
+ kill "$server_pid" 2>/dev/null
+ wait "$server_pid" 2>/dev/null
+ break
+ fi
+
+ local srv_tcp0 srv_tcp1
+ srv_tcp0=$(tc_filter_pkt_count "$NS2" veth0b)
+ srv_tcp1=$(tc_filter_pkt_count "$NS2" veth1b)
+ local srv_delta0=$(( ${srv_tcp0:-0} - ${srv_base0:-0} ))
+ local srv_delta1=$(( ${srv_tcp1:-0} - ${srv_base1:-0} ))
+
+ if [ "$srv_delta0" -gt 0 ] && [ "$srv_delta1" -gt 0 ]; then
+ path_splits=$((path_splits + 1))
+ fi
+
+ kill "$client_pid" 2>/dev/null
+ wait "$client_pid" 2>/dev/null
+ kill "$server_pid" 2>/dev/null
+ wait "$server_pid" 2>/dev/null
+ done
+
+ if [ "$path_splits" -gt 0 ]; then
+ check_err 1 "$path_splits/$ECMP_REBUILD_ROUNDS had split server path"
+ fi
+
+ log_test "Syncookie server ECMP path consistent"
+}
+
+require_command socat
+
+trap 'defer_scopes_cleanup; cleanup_all_ns' EXIT
+setup || exit $?
+tests_run
+exit "$EXIT_STATUS"
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-22 21:57 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-22 21:57 [PATCH net-next v8 0/2] tcp: rehash onto different local ECMP path on retransmit timeout Neil Spring
2026-05-22 21:57 ` [PATCH net-next v8 1/2] " Neil Spring
2026-05-22 21:57 ` [PATCH net-next v8 2/2] selftests: net: add local ECMP rehash test Neil Spring
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox