Re: [PATCH net] ip: make IP identifiers less predictable

[Willy Tarreau <w@1wt.eu>]

On Fri, Jul 25, 2014 at 08:38:17PM +0200, Eric Dumazet wrote:
> On Fri, 2014-07-25 at 11:35 -0700, Linus Torvalds wrote:
> > On Fri, Jul 25, 2014 at 11:09 AM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> > >
> > > We might change the hash to use both daddr & saddr to increase
> > > protection.
> > 
> > .. and maybe protocol too, so that you can't easily use icmp echo
> > packets to do it for udp packets etc. The underlying jhash is
> > jhash_3words(), so that would actually be fairly natural for at least
> > ipv4 (the ipv6 case I didn't look at).
> 
> Right, in fact saddr is probably not worth it.

Yes it is, at least to isolate public and private networks.

> Its not like servers have dozen of IPv4 addresses anyway...

Actually some have many more, even hundreds sometimes (until people
realize they can bind networks to the loopback or do transparent
proxy, where the principle is still true). It's especially true with
front equipments such as reverse proxies and load balancers. SSL
deployed all over the web has made that much worse despite the
introduction of SNI which is not supported by all clients, because
while hosting providers used to assign just a few IPs on which they
bound their servers using virtual hosting, with SSL they tend to
offer one IP address per customer.

Regards,
Willy