github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ipv4: use zero IPID for atomic datagrams on connected sockets

Browse Source 
ip_select_ident_segs() uses the per-socket private generator
for connected sockets, even for packets with IP_DF set.

This was historically done to work around buggy Windows95/2000
VJ header compression implementations, dropping every other
packet in a TCP stream when the IP ID field did not change.

RFC 6864 section 4.2 states that "Originating sources MAY set the
IPv4 ID field of atomic datagrams to any value".

Packets with IP_DF set and skb->ignore_df cleared can not be
fragmented, neither locally (ip_fragment() refuses to do so)
nor by routers on the path.

Set their IPID to zero, like we already do for unconnected sockets
and in ip_build_and_send_pkt(). FreeBSD also does the same by
default (net.inet.ip.rfc6864 = 1).

For GSO packets, segments get IP IDs 0, 1, ..., n-1 from GSO/TSO.
This does not hurt GRO on receivers, because TCP already forces
a PSH flag on every TSO packet since commit 051ba67447
("tcp: force a PSH flag on TSO packets"), so GRO already flushes
at TSO packet boundaries.

Connected sockets still use their private generator for packets
without IP_DF, or with skb->ignore_df set. Update the inet_id
kernel-doc accordingly.

This avoids an atomic operation on a shared cache line for
connected UDP sockets using IP_PMTUDISC_DO/IP_PMTUDISC_PROBE,
and TCP no longer touches inet->inet_id in the fast path.

Minor side effects: IP IDs can no longer be used to distinguish
network duplicates from TCP retransmits, or to correlate packet
captures taken at different points. OS fingerprints will also change.

Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20261001155633.2562504-1-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Eric Dumazet 2026-10-01 15:56:33 +00:00 committed by Jakub Kicinski
parent a9d60b0869
commit 9a550198d4
2 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/net/inet_sock.h
View File

@ -207,7 +207,7 @@ struct rtable;
* @inet_saddr - Sending source
* @uc_ttl - Unicast TTL
* @inet_sport - Source port
* @inet_id - ID counter for DF pkts
* @inet_id - ID counter for non atomic pkts
* @tos - TOS
* @mc_ttl - Multicasting TTL
* @uc_index - Unicast outgoing device index

15
include/net/ip.h
View File

@ -584,6 +584,13 @@ static inline void ip_select_ident_segs(struct net *net, struct sk_buff *skb,
{
struct iphdr *iph = ip_hdr(skb);
/* RFC 6864: the IPv4 ID of atomic datagrams has no meaning.
* DF packets without ignore_df can not be fragmented.
*/
if ((iph->frag_off & htons(IP_DF)) && !skb->ignore_df) {
iph->id = 0;
return;
}
/* We had many attacks based on IPID, use the private
* generator as much as we can.
*/
@ -603,12 +610,8 @@ static inline void ip_select_ident_segs(struct net *net, struct sk_buff *skb,
iph->id = htons(val);
return;
}
if ((iph->frag_off & htons(IP_DF)) && !skb->ignore_df) {
iph->id = 0;
} else {
/* Unfortunately we need the big hammer to get a suitable IPID */
__ip_select_ident(net, iph, segs);
}
/* Unfortunately we need the big hammer to get a suitable IPID */
__ip_select_ident(net, iph, segs);
}
static inline void ip_select_ident(struct net *net, struct sk_buff *skb,