Re: [PATCH net 3/7] tcp: resalt the secret every 10 seconds

[Stephen Hemminger]

On Wed, 27 Apr 2022 08:52:29 +0200
Willy Tarreau <w@xxxxxx> wrote:

> From: Eric Dumazet <edumazet@xxxxxxxxxx>
> 
> In order to limit the ability for an observer to recognize the source
> ports sequence used to contact a set of destinations, we should
> periodically shuffle the secret. 10 seconds looks effective enough
> without causing particular issues.
> 
> Cc: Moshe Kol <moshe.kol@xxxxxxxxxxxxxxx>
> Cc: Yossi Gilad <yossi.gilad@xxxxxxxxxxxxxxx>
> Cc: Amit Klein <aksecurity@xxxxxxxxx>
> Tested-by: Willy Tarreau <w@xxxxxx>
> Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
> ---
>  net/core/secure_seq.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
> index 2cdd43a63f64..200ab4686275 100644
> --- a/net/core/secure_seq.c
> +++ b/net/core/secure_seq.c
> @@ -22,6 +22,8 @@
>  static siphash_aligned_key_t net_secret;
>  static siphash_aligned_key_t ts_secret;
>  

Rather than hard coding, why not have a sysctl knob for this?
That way the tinfoil types can set it smaller.