tcp: allow to turn tcp timestamp randomization off

Eric says: "By looking at tcpdump, and TS val of xmit packets of multiple
flows, we can deduct the relative qdisc delays (think of fq pacing).
This should work even if we have one flow per remote peer."

Having random per flow (or host) offsets doesn't allow that anymore so add
a way to turn this off.

Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 5af48dd7c5fc106705d4ef0034a4f3663c17294e..5ca567fa6b8cb1570d73c26f79ea370fdd4ca97f 100644 (file)
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -610,8 +610,13 @@ tcp_syn_retries - INTEGER
        with the current initial RTO of 1second. With this the final timeout
        for an active TCP connection attempt will happen after 127seconds.
 
-tcp_timestamps - BOOLEAN
-       Enable timestamps as defined in RFC1323.
+tcp_timestamps - INTEGER
+Enable timestamps as defined in RFC1323.
+       0: Disabled.
+       1: Enable timestamps as defined in RFC1323 and use random offset for
+       each connection rather than only using the current time.
+       2: Like 1, but without random offsets.
+       Default: 1
 
 tcp_min_tso_segs - INTEGER
        Minimal number of segments per TSO frame.

diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
index a8d6062cbb4a9558e823893cf743000189d96b23..88a8e429fc3e6d5779a5fa989dfecb330acb1cbe 100644 (file)
--- a/net/core/secure_seq.c
+++ b/net/core/secure_seq.c
@@ -12,6 +12,7 @@
 #include <net/secure_seq.h>
 
 #if IS_ENABLED(CONFIG_IPV6) || IS_ENABLED(CONFIG_INET)
+#include <net/tcp.h>
 #define NET_SECRET_SIZE (MD5_MESSAGE_BYTES / 4)
 
 static u32 net_secret[NET_SECRET_SIZE] ____cacheline_aligned;
@@ -58,7 +59,7 @@ u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
 
        md5_transform(hash, secret);
 
-       *tsoff = hash[1];
+       *tsoff = sysctl_tcp_timestamps == 1 ? hash[1] : 0;
        return seq_scale(hash[0]);
 }
 EXPORT_SYMBOL(secure_tcpv6_sequence_number);
@@ -100,7 +101,7 @@ u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
 
        md5_transform(hash, net_secret);
 
-       *tsoff = hash[1];
+       *tsoff = sysctl_tcp_timestamps == 1 ? hash[1] : 0;
        return seq_scale(hash[0]);
 }
 

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2257de244622ac8cfd91d1ca5d7a8239b282ac1d..fe668c1b9cedd90a3d6546be6af44b70bd0b3d7f 100644 (file)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -85,6 +85,7 @@ int sysctl_tcp_dsack __read_mostly = 1;
 int sysctl_tcp_app_win __read_mostly = 31;
 int sysctl_tcp_adv_win_scale __read_mostly = 1;
 EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
+EXPORT_SYMBOL(sysctl_tcp_timestamps);
 
 /* rfc5961 challenge ack rate limiting */
 int sysctl_tcp_challenge_ack_limit = 1000;