Re: [PATCH v2 net] ip: make IP identifiers less predictable

[Hannes Frederic Sowa <hannes@redhat.com>]

On Fr, 2014-07-25 at 21:50 +0200, Eric Dumazet wrote:
> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> index cb9df0eb4023..73372e8016b9 100644
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -545,6 +545,7 @@ static void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
>  	net_get_random_once(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd));
>  
>  	hash = __ipv6_addr_jhash(&rt->rt6i_dst.addr, ip6_idents_hashrnd);
> +	hash ^= __ipv6_addr_jhash(&rt->rt6i_src.addr, fhdr->nexthdr);

I am not sure if we should hash fhdr->nexthdr for IPv6.

If you look at the reassembly engine, we compare protocol value for IPv4
but not for IPv6 (we even don't save it).

Even if we only transmit packets with UDP protocol type we might end up
having an extension header right after the fragmentation header of
another type later in the flow. We can end up using a different bucket
and thus reusing a fragmentation id wich has been seen before in this
flow possibly resulting in reassembly issues.

I don't see such a problem for IPv4.

Otherwise very nice patch, thanks,
Hannes