[PATCH v2] net: ip/tnl: Set iph->id only when don't fragment is not set

[Oliver Herms <oliver.peter.herms@gmail.com>]

In IPv4 the identification field ensures that fragments of different datagrams
are not mixed by the receiver. Packets with Don't Fragment (DF) flag set are not
to be fragmented in transit and thus don't need an identification.
From RFC 6864 "Updated Specification of the IPv4 ID Field" section 4.1:
"The IPv4 ID field MUST NOT be used for purposes other than fragmentation and
reassembly."
Calculating the identification takes significant CPU time.
This patch will increase IP tunneling performance by ~10% unless DF is not set.
However, DF is set by default which is best practice.
For security reason this patch will set ID to zero when ID is not needed to
prevent leaking random information.

Signed-off-by: Oliver Herms <oliver.peter.herms@gmail.com>
---
Changes in v2:
  - Add source of assertion into commit message.
  - Correct check of DF flag.
  - Set iph->id to 0 when DF if not set to avoid leaking information.

 net/ipv4/ip_tunnel_core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 1452a97914a0..ea12c8cc9e83 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -73,7 +73,11 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
 	iph->daddr	=	dst;
 	iph->saddr	=	src;
 	iph->ttl	=	ttl;
-	__ip_select_ident(net, iph, skb_shinfo(skb)->gso_segs ?: 1);
+
+	if (likely((iph->frag_off & htons(IP_DF)) == htons(IP_DF)))
+		iph->id = 0;
+	else
+		__ip_select_ident(net, iph, skb_shinfo(skb)->gso_segs ?: 1);
 
 	err = ip_local_out(net, sk, skb);
 
-- 
2.19.1