inet: stop leaking jiffies on the wire
Historically linux tried to stick to RFC 791, 1122, 2003 for IPv4 ID field generation. RFC 6864 made clear that no matter how hard we try, we can not ensure unicity of IP ID within maximum lifetime for all datagrams with a given source address/destination address/protocol tuple. Linux uses a per socket inet generator (inet_id), initialized at connection startup with a XOR of 'jiffies' and other fields that appear clear on the wire. Thiemo Nagel pointed that this strategy is a privacy concern as this provides 16 bits of entropy to fingerprint devices. Let's switch to a random starting point, this is just as good as far as RFC 6864 is concerned and does not leak anything critical. Fixes: 1da177e4 ("Linux-2.6.12-rc2") Signed-off-by:Eric Dumazet <edumazet@google.com> Reported-by:
Thiemo Nagel <tnagel@google.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
parent
c8c2cd81
-
mentioned in commit 03c2ac95
-
mentioned in commit 4fa6002a
-
mentioned in commit 96df1ec2
-
mentioned in commit 07de7389
-
mentioned in commit 888913ed
-
mentioned in commit 993e4005
-
mentioned in commit afd9a802
-
mentioned in commit a67a32da
-
mentioned in commit 40e068f5
-
mentioned in commit e39bc439
-
mentioned in commit c1fb8e44
-
mentioned in commit 0f1cd1a7
Please register or sign in to comment