On Tue, Aug 4, 2020 at 5:57 PM Tom Herbert <t...@herbertland.com> wrote: > > The definition for symmetric keys does not include the flow label so > that when symmetric keys is used a non-zero IPv6 flow label is not > extracted. Symmetric keys are used in functions to compute the flow > hash for packets, and these functions also set "stop at flow label". > The upshot is that for IPv6 packets with a non-zero flow label, hashes > are only based on the address two tuple and there is no input entropy > from transport layer information. This patch fixes this bug.
If this is a bug fix, it should probably target net and have a Fixes tag. Should the actual fix be to remove the FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL argument from __skb_get_hash_symmetric? The original commit mentions the symmetric key flow dissector to compute a flat symmetric hash over only the protocol, addresses and ports. Autoflowlabel uses symmetric __get_hash_from_flowi6 to derive a flow label, but this cannot be generally relied on. RFC 6437 suggests even a PRNG as input, for instance.
