On Mon, Jan 06, 2014 at 01:43:40PM +0100, Hannes Frederic Sowa wrote: [...] > > > Hmm, some of them look like good candidates for net_get_random_once. I don't > > > see such a problem with draining entropy pool, especially as they don't run > > > that early and they don't request so many random bits. > > > > I specifically did not use net_get_random_once once because checkentry is > > not a hotpath. > > > > I don't see why get_random_bytes use increases the security margin, especially > > considering none of these hashes have periodic run-time rehashing? > > > > But sure, if you think this change is a problem, Pablo can just revert it. > > I don't know if it is a real problem. Most of the time the initial seed > should be enough, but I guess get_random_bytes would still be a more > defensive choice. I would have used it. ;) OK, I have reverted this patch, thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
