Re: [PATCH] ipv4: remove ip_rt_secret timer (v3)

[Eric Dumazet <eric.dumazet@gmail.com>]

Le vendredi 07 mai 2010 à 15:55 -0400, Neil Horman a écrit :
> Hey-
> 	Sorry for the delay, but I got interested in Erics suggestion of
> changing how we update rt_genid, and had a few thoughts.  Heres version 3 of
> this patch:
> 

We have time, no hurry Neil.

> Change Notes:
> 
> 1) Removed the secret_interval binary interface entry in the list (forgot to do
> that before)
> 
> 2) Took Erics Suggestion to change the update for net->ipv4.rt_genid.  Now
> instead of doing a small incremental change, we simply grab 32 new random bits.
> 

My suggestion was to initialize _once_ at boot time, the _full_ 32bits.

Not to change the perturbations, they are very fine, and need no extra
CONFIG_SOME_MAGICAL_SWITCH.

We have a guarantee that no duplicates are delivered unless you perform
2^24 generations in a short period of time.

But because you want to change full 32bits, you need a complex dupcheck
thing ?

> 3) The change in (2) got me thinking that part of the reason we used the Jenkins
> hash in rt_genid was to ensure non-repetion of id's in a short time period
> (which is important, so as not to inadvertently reuse route cache entries that
> should be getting expired).  While extra randomness makes it harder for
> attackers to guess the secret, it makes it possible to return to previously
> guessed values as well (if they're lucky).  As such, I created a configurable
> option, CONFIG_GENID_DUPCHECK.  With this option on, the low order 8 bits of the
> genid are replaced with a rolling counter, that increments on each new genid.
> This creates in effect, a 256 deep list of previously used genid values.  In
> rt_drop we compare the genids for duplicates.  If we find that 2 genid values
> have different indexes, but idential remaining bits, they are noted as a repeat
> genid, and we call rt_cache_invalidate to generate a new genid and avoid the
> duplication problem.
> 
> 

This is not necessary and over engineering if you ask me.

You now rely on probabilistic rules, and depends on get_random_bytes()
be really random, or a new CONFIG setting...

What exact problem do you want to solve Neil ?

Please submit your initial patch, with the small changes :

1) Remove the secret_interval binary interface entry in the list 

2) Initialize full 32bits at struct net init time.

Thanks