netdev - IPV4: Enable IP_ID sequencing for all traffic (inquiring minds want to know why its set to zero)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 16 Jul 2008 09:56:21 -0500
From:	Christoph Lameter <cl@...ux-foundation.org>
To:	netdev@...r.kernel.org
Subject: IPV4: Enable IP_ID sequencing for all traffic (inquiring minds want
 to know why its set to zero)


There is some security reason why we set IP_ID == 0 right? Could someone point me at the discussions that lead to having IP_ID be zero? Have not been involved in network that much so forgive my ignorance.... and I can only find some hints about why this was done here and there using google.



Here is a patch that would reenable IP_ID sequencing


Subject: [IPV4] Enable IP_ID sequencing on all traffic

The current Linux sources disable IP_ID if the DF flag is set (not always. There
is an exception for VJ compression on certain windows platforms).

Just remove the check for the DF flag and always generate the ipid.

Signed-off-by: Christoph Lameter <cl@...ux-foundation.org>

Index: linux-2.6/include/net/ip.h
===================================================================
--- linux-2.6.orig/include/net/ip.h	2008-07-16 08:47:50.000000000 -0500
+++ linux-2.6/include/net/ip.h	2008-07-16 08:48:01.000000000 -0500
@@ -217,16 +217,7 @@
 
 static inline void ip_select_ident(struct iphdr *iph, struct dst_entry *dst, struct sock *sk)
 {
-	if (iph->frag_off & htons(IP_DF)) {
-		/* This is only to work around buggy Windows95/2000
-		 * VJ compression implementations.  If the ID field
-		 * does not change, they drop every other packet in
-		 * a TCP stream using header compression.
-		 */
-		iph->id = (sk && inet_sk(sk)->daddr) ?
-					htons(inet_sk(sk)->id++) : 0;
-	} else
-		__ip_select_ident(iph, dst, 0);
+	__ip_select_ident(iph, dst, 0);
 }
 
 static inline void ip_select_ident_more(struct iphdr *iph, struct dst_entry *dst, struct sock *sk, int more)
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html