[PATCH] [PATCH net v3] ipv6: remove min MTU check for ipsec tunnels

[PATCH] [PATCH net v3] ipv6: remove min MTU check for ipsec tunnels

[Ashwanth Goli]

With 749439bfac "fix udpv6 sendmsg crash caused by too small MTU"
ipsec tunnels that report a MTU less than IPV6_MIN_MTU are broken
even for packets that are smaller than IPV6_MIN_MTU.

According to rfc2473#section-7.1

    if the original IPv6 packet is equal or  smaller  than  the
    IPv6 minimum link MTU, the tunnel entry-point node
    encapsulates the original packet, and subsequently
    fragments the resulting IPv6 tunnel packet into IPv6
    fragments that do not exceed the Path MTU to the tunnel
    exit-point.

Dropping the MTU check for ipsec tunnel destinations.

Signed-off-by: Ashwanth Goli <ashwanth@codeaurora.org>
---
 net/ipv6/ip6_output.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 2e891d2..ea1ef1b 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1235,7 +1235,7 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
 		if (np->frag_size)
 			mtu = np->frag_size;
 	}
-	if (mtu < IPV6_MIN_MTU)
+	if (mtu < IPV6_MIN_MTU && !(rt->dst.flags & DST_XFRM_TUNNEL))
 		return -EINVAL;
 	cork->base.fragsize = mtu;
 	if (dst_allfrag(xfrm_dst_path(&rt->dst)))
-- 
1.9.1

Re: [PATCH] [PATCH net v3] ipv6: remove min MTU check for ipsec tunnels

[David Miller]

From: Ashwanth Goli <ashwanth@codeaurora.org>
Date: Thu, 10 May 2018 23:15:44 +0530

> With 749439bfac "fix udpv6 sendmsg crash caused by too small MTU"
> ipsec tunnels that report a MTU less than IPV6_MIN_MTU are broken
> even for packets that are smaller than IPV6_MIN_MTU.
> 
> According to rfc2473#section-7.1
> 
>     if the original IPv6 packet is equal or  smaller  than  the
>     IPv6 minimum link MTU, the tunnel entry-point node
>     encapsulates the original packet, and subsequently
>     fragments the resulting IPv6 tunnel packet into IPv6
>     fragments that do not exceed the Path MTU to the tunnel
>     exit-point.
> 
> Dropping the MTU check for ipsec tunnel destinations.
> 
> Signed-off-by: Ashwanth Goli <ashwanth@codeaurora.org>

I still hold the fundamental objection to your change which I expressed
from the beginning.

I'll try to be more clear.

This RFC language is talking about tunnels _IN GENERAL_.

Your patch is modifying behavior only for IPSEC tunnels.

That doesn't make any sense.

Either the RFC language is to be followed, and therefore applied
to all tunnels.  Or it doesn't.

I don't see any logic which makes it such that only IPSEC tunnels
should follow this MTU checking rule.

Please do not resubmit this patch again until you resolve this
issue.

Thank you.