| Message ID | 20210220130115.2914135-1-eyal.birger@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [ipsec,v2] xfrm: interface: fix ipv4 pmtu check to honor ip header df | expand |
2021-02-20, 15:01:15 +0200, Eyal Birger wrote: > Frag needed should only be sent if the header enables DF. > > This fix allows packets larger than MTU to pass the xfrm interface > and be fragmented after encapsulation, aligning behavior with > non-interface xfrm. > > Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces") > Signed-off-by: Eyal Birger <eyal.birger@gmail.com> > > ----- > > v2: better align coding with ip_vti LGTM. We also need to do the same thing in ip_vti and ip6_vti. Do you want to take care of it, or should I? Either way, for this patch: Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> -- Sabrina
On 23/02/2021 16:12, Sabrina Dubroca wrote: > LGTM. We also need to do the same thing in ip_vti and ip6_vti. Do you > want to take care of it, or should I? > See the thread https://lore.kernel.org/netdev/1552865877-13401-1-git-send-email-bram-yvahk@mail.wizbit.be/ (I'm assuming the patches no longer applies cleanly but given that I was ignored last time I will not be resubmitting them.) -- Bram
Hi, On Tue, Feb 23, 2021 at 5:18 PM Sabrina Dubroca <sd@queasysnail.net> wrote: > > 2021-02-20, 15:01:15 +0200, Eyal Birger wrote: > > Frag needed should only be sent if the header enables DF. > > > > This fix allows packets larger than MTU to pass the xfrm interface > > and be fragmented after encapsulation, aligning behavior with > > non-interface xfrm. > > > > Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces") > > Signed-off-by: Eyal Birger <eyal.birger@gmail.com> > > > > ----- > > > > v2: better align coding with ip_vti > > LGTM. We also need to do the same thing in ip_vti and ip6_vti. Do you > want to take care of it, or should I? I can submit the same fix for vti{,6}. > > Either way, for this patch: > Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Thanks! Eyal.
On Tue, Feb 23, 2021 at 04:12:34PM +0100, Sabrina Dubroca wrote: > 2021-02-20, 15:01:15 +0200, Eyal Birger wrote: > > Frag needed should only be sent if the header enables DF. > > > > This fix allows packets larger than MTU to pass the xfrm interface > > and be fragmented after encapsulation, aligning behavior with > > non-interface xfrm. > > > > Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces") > > Signed-off-by: Eyal Birger <eyal.birger@gmail.com> > > > > ----- > > > > v2: better align coding with ip_vti > > LGTM. We also need to do the same thing in ip_vti and ip6_vti. Do you > want to take care of it, or should I? > > Either way, for this patch: > Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Applied, thanks everyone!
diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c index 697cdcfbb5e1..3f42c2f15ba4 100644 --- a/net/xfrm/xfrm_interface.c +++ b/net/xfrm/xfrm_interface.c @@ -305,6 +305,8 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); } else { + if (!(ip_hdr(skb)->frag_off & htons(IP_DF))) + goto xmit; icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu)); } @@ -313,6 +315,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) return -EMSGSIZE; } +xmit: xfrmi_scrub_packet(skb, !net_eq(xi->net, dev_net(dev))); skb_dst_set(skb, dst); skb->dev = tdev;
Frag needed should only be sent if the header enables DF. This fix allows packets larger than MTU to pass the xfrm interface and be fragmented after encapsulation, aligning behavior with non-interface xfrm. Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces") Signed-off-by: Eyal Birger <eyal.birger@gmail.com> ----- v2: better align coding with ip_vti --- net/xfrm/xfrm_interface.c | 3 +++ 1 file changed, 3 insertions(+)