netdev - [PATCH net-next] flow_dissector: Add IPv6 flow label to symmetric keys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue,  4 Aug 2020 08:56:42 -0700
From:   Tom Herbert <tom@...bertland.com>
To:     davem@...emloft.net, netdev@...r.kernel.org
Cc:     Tom Herbert <tom@...bertland.com>
Subject: [PATCH net-next] flow_dissector: Add IPv6 flow label to symmetric keys

The definition for symmetric keys does not include the flow label so
that when symmetric keys is used a non-zero IPv6 flow label is not
extracted. Symmetric keys are used in functions to compute the flow
hash for packets, and these functions also set "stop at flow label".
The upshot is that for IPv6 packets with a non-zero flow label, hashes
are only based on the address two tuple and there is no input entropy
from transport layer information. This patch fixes this bug.
---
 net/core/flow_dissector.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 29806eb765cf..d72e13d125fb 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1765,6 +1765,10 @@ static const struct flow_dissector_key flow_keys_dissector_symmetric_keys[] = {
 		.key_id = FLOW_DISSECTOR_KEY_PORTS,
 		.offset = offsetof(struct flow_keys, ports),
 	},
+	{
+		.key_id = FLOW_DISSECTOR_KEY_FLOW_LABEL,
+		.offset = offsetof(struct flow_keys, tags),
+	},
 };
 
 static const struct flow_dissector_key flow_keys_basic_dissector_keys[] = {
-- 
2.25.1