From: Daniel Salzman <daniel.salzman@nic.cz>
Date: Tue, 6 Jul 2021 20:31:25 +0000 (+0200)
Subject: XDP-TCP: refactor Siphash secret handling
X-Git-Tag: v3.1.0~44^2~13
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7ebdd14afa3d51f078d4be2799f0ec0c3de0e12e;p=thirdparty%2Fknot-dns.git

XDP-TCP: refactor Siphash secret handling
---

diff --git a/src/libdnssec/random.h b/src/libdnssec/random.h
index f6abb94e9d..3a575333b3 100644
--- a/src/libdnssec/random.h
+++ b/src/libdnssec/random.h
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2020 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2021 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -73,6 +73,7 @@ static inline uint32_t dnssec_random_uint32_t(void);
 /*! \cond */
 dnssec_register_random_type(uint16_t);
 dnssec_register_random_type(uint32_t);
+dnssec_register_random_type(uint64_t);
 /*! \endcond */
 
 /*! @} */
diff --git a/src/libknot/xdp/tcp.c b/src/libknot/xdp/tcp.c
index 93c12a9946..49c7081a32 100644
--- a/src/libknot/xdp/tcp.c
+++ b/src/libknot/xdp/tcp.c
@@ -49,14 +49,11 @@ static size_t sockaddr_data_len(const struct sockaddr_in6 *rem, const struct soc
 }
 
 static uint64_t hash_four_tuple(const struct sockaddr_in6 *rem, const struct sockaddr_in6 *loc,
-                                uint32_t hash_secret[4])
+                                knot_tcp_table_t *table)
 {
 	size_t socka_data_len = sockaddr_data_len(rem, loc);
-	SIPHASH_KEY key;
-	//assert(sizeof(key) == sizeof(hash_secret)); // beware, sizeof(hash_secret) == sizeof(uint32_t*)
-	memcpy(&key, hash_secret, sizeof(key));
 	SIPHASH_CTX ctx;
-	SipHash24_Init(&ctx, &key);
+	SipHash24_Init(&ctx, (const SIPHASH_KEY *)(table->hash_secret));
 	SipHash24_Update(&ctx, rem, socka_data_len);
 	SipHash24_Update(&ctx, loc, socka_data_len);
 	return SipHash24_End(&ctx);
@@ -84,9 +81,9 @@ knot_tcp_table_t *knot_tcp_table_new(size_t size)
 	table->size = size;
 	init_list(tcp_table_timeout(table));
 
-	for (size_t i = 0; i < sizeof(table->hash_secret) / sizeof(*table->hash_secret); i++) {
-		table->hash_secret[i] = dnssec_random_uint32_t();
-	}
+	assert(sizeof(table->hash_secret) == sizeof(SIPHASH_KEY));
+	table->hash_secret[0] = dnssec_random_uint64_t();
+	table->hash_secret[1] = dnssec_random_uint64_t();
 
 	return table;
 }
@@ -107,7 +104,7 @@ static knot_tcp_conn_t **tcp_table_lookup(const struct sockaddr_in6 *rem,
                                           const struct sockaddr_in6 *loc,
                                           uint64_t *hash, knot_tcp_table_t *table)
 {
-	*hash = hash_four_tuple(rem, loc, table->hash_secret);
+	*hash = hash_four_tuple(rem, loc, table);
 	size_t sdl = sockaddr_data_len(rem, loc);
 	knot_tcp_conn_t **res = table->conns + (*hash % table->size);
 	while (*res != NULL) {
diff --git a/src/libknot/xdp/tcp.h b/src/libknot/xdp/tcp.h
index 8c15b528dd..48c77160fb 100644
--- a/src/libknot/xdp/tcp.h
+++ b/src/libknot/xdp/tcp.h
@@ -74,7 +74,7 @@ typedef struct {
 	size_t size;
 	size_t usage;
 	size_t inbufs_total;
-	uint32_t hash_secret[4];
+	uint64_t hash_secret[2];
 	knot_tcp_conn_t *conns[];
 } knot_tcp_table_t;