Re: [PATCH v2 net 1/7] secure_seq: use the 64 bits of the siphash for port offset calculation

[Jason A. Donenfeld]

Hi Willy,

On Thu, Apr 28, 2022 at 02:39:55PM +0200, Willy Tarreau wrote:
> SipHash replaced MD5 in secure_ipv{4,6}_port_ephemeral() via commit
> 7cd23e5300c1 ("secure_seq: use SipHash in place of MD5"), but the output
> remained truncated to 32-bit only. In order to exploit more bits from the
> hash, let's make the functions return the full 64-bit of siphash_3u32().
> We also make sure the port offset calculation in __inet_hash_connect()
> remains done on 32-bit to avoid the need for div_u64_rem() and an extra
> cost on 32-bit systems.
> 
> Cc: Jason A. Donenfeld <Jason@xxxxxxxxx>
> Cc: Moshe Kol <moshe.kol@xxxxxxxxxxxxxxx>
> Cc: Yossi Gilad <yossi.gilad@xxxxxxxxxxxxxxx>
> Cc: Amit Klein <aksecurity@xxxxxxxxx>
> Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
> Signed-off-by: Willy Tarreau <w@xxxxxx>
> ---
>  include/net/inet_hashtables.h |  2 +-
>  include/net/secure_seq.h      |  4 ++--
>  net/core/secure_seq.c         |  4 ++--
>  net/ipv4/inet_hashtables.c    | 10 ++++++----
>  net/ipv6/inet6_hashtables.c   |  4 ++--
>  5 files changed, 13 insertions(+), 11 deletions(-)

For the secure_seq parts:

Acked-by: Jason A. Donenfeld <Jason@xxxxxxxxx> # For secure_seq.[ch]

Thanks,
Jason