The definition for symmetric keys does not include the flow label so
that when symmetric keys is used a non-zero IPv6 flow label is not
extracted. Symmetric keys are used in functions to compute the flow
hash for packets, and these functions also set "stop at flow label".
The upshot is that for IPv6 packets with a non-zero flow label, hashes
are only based on the address two tuple and there is no input entropy
from transport layer information. This patch fixes this bug.
---
net/core/flow_dissector.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 29806eb765cf..d72e13d125fb 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1765,6 +1765,10 @@ static const struct flow_dissector_key
flow_keys_dissector_symmetric_keys[] = {
.key_id = FLOW_DISSECTOR_KEY_PORTS,
.offset = offsetof(struct flow_keys, ports),
},
+ {
+ .key_id = FLOW_DISSECTOR_KEY_FLOW_LABEL,
+ .offset = offsetof(struct flow_keys, tags),
+ },
};
static const struct flow_dissector_key flow_keys_basic_dissector_keys[] = {
--
2.25.1
