diff options
| author |   Ansis Atteka <aatteka@nicira.com> | 2013-09-18 15:29:53 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2013-09-19 14:11:15 -0400 |
| commit | 703133de331a7a7df47f31fb9de51dc6f68a9de8 (patch) | |
| tree | 0c6c49e15c9461cd3a563d17062a866d2fafd6fa /net/ipv4/inetpeer.c | |
| parent | ip: use ip_hdr() in __ip_make_skb() to retrieve IP header (diff) | |
| download | linux-dev-703133de331a7a7df47f31fb9de51dc6f68a9de8.tar.xz linux-dev-703133de331a7a7df47f31fb9de51dc6f68a9de8.zip | |
ip: generate unique IP identificator if local fragmentation is allowed
If local fragmentation is allowed, then ip_select_ident() and
ip_select_ident_more() need to generate unique IDs to ensure
correct defragmentation on the peer.
For example, if IPsec (tunnel mode) has to encrypt large skbs
that have local_df bit set, then all IP fragments that belonged
to different ESP datagrams would have used the same identificator.
If one of these IP fragments would get lost or reordered, then
peer could possibly stitch together wrong IP fragments that did
not belong to the same datagram. This would lead to a packet loss
or data corruption.
Signed-off-by: Ansis Atteka <aatteka@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/inetpeer.c')
| -rw-r--r-- | net/ipv4/inetpeer.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c index 000e3d239d64..33d5537881ed 100644 --- a/net/ipv4/inetpeer.c +++ b/net/ipv4/inetpeer.c @@ -32,8 +32,8 @@ * At the moment of writing this notes identifier of IP packets is generated * to be unpredictable using this code only for packets subjected * (actually or potentially) to defragmentation. I.e. DF packets less than - * PMTU in size uses a constant ID and do not use this code (see - * ip_select_ident() in include/net/ip.h). + * PMTU in size when local fragmentation is disabled use a constant ID and do + * not use this code (see ip_select_ident() in include/net/ip.h). * * Route cache entries hold references to our nodes. * New cache entries get references via lookup by destination IP address in |