Re: [PATCH] net/ipv4: always honour route mtu during forwarding

From: "Maciej Żenczykowski" <maze@google.com>
To: "Maciej Żenczykowski" <maze@google.com>,
	"David S . Miller" <davem@davemloft.net>
Cc: Linux Network Development Mailing List <netdev@vger.kernel.org>,
	Willem de Bruijn <willemb@google.com>,
	Lorenzo Colitti <lorenzo@google.com>,
	Sunmeet Gill <sgill@quicinc.com>,
	Vinay Paradkar <vparadka@qti.qualcomm.com>,
	Tyler Wear <twear@quicinc.com>, David Ahern <dsahern@kernel.org>
Subject: Re: [PATCH] net/ipv4: always honour route mtu during forwarding
Date: Tue, 22 Sep 2020 21:46:22 -0700	[thread overview]
Message-ID: <CANP3RGcTy5MyAyChUh7pTma60aLcBmOV4kKjh_OnGtBZag-gbg@mail.gmail.com> (raw)
In-Reply-To: <20200923044059.3442423-1-zenczykowski@gmail.com>

On Tue, Sep 22, 2020 at 9:41 PM Maciej Żenczykowski
<zenczykowski@gmail.com> wrote:
>
> From: Maciej Żenczykowski <maze@google.com>
>
> Documentation/networking/ip-sysctl.txt:46 says:
>   ip_forward_use_pmtu - BOOLEAN
>     By default we don't trust protocol path MTUs while forwarding
>     because they could be easily forged and can lead to unwanted
>     fragmentation by the router.
>     You only need to enable this if you have user-space software
>     which tries to discover path mtus by itself and depends on the
>     kernel honoring this information. This is normally not the case.
>     Default: 0 (disabled)
>     Possible values:
>     0 - disabled
>     1 - enabled
>
> Which makes it pretty clear that setting it to 1 is a potential
> security/safety/DoS issue, and yet it is entirely reasonable to want
> forwarded traffic to honour explicitly administrator configured
> route mtus (instead of defaulting to device mtu).
>
> Indeed, I can't think of a single reason why you wouldn't want to.
> Since you configured a route mtu you probably know better...
>
> It is pretty common to have a higher device mtu to allow receiving
> large (jumbo) frames, while having some routes via that interface
> (potentially including the default route to the internet) specify
> a lower mtu.
>
> Note that ipv6 forwarding uses device mtu unless the route is locked
> (in which case it will use the route mtu).
>
> This approach is not usable for IPv4 where an 'mtu lock' on a route
> also has the side effect of disabling TCP path mtu discovery via
> disabling the IPv4 DF (don't frag) bit on all outgoing frames.
>
> I'm not aware of a way to lock a route from an IPv6 RA, so that also
> potentially seems wrong.
>
> Signed-off-by: Maciej Żenczykowski <maze@google.com>
> Cc: Eric Dumazet <maze@google.com>
> Cc: Willem de Bruijn <willemb@google.com>
> Cc: Lorenzo Colitti <lorenzo@google.com>
> Cc: Sunmeet Gill (Sunny) <sgill@quicinc.com>
> Cc: Vinay Paradkar <vparadka@qti.qualcomm.com>
> Cc: Tyler Wear <twear@quicinc.com>
> Cc: David Ahern <dsahern@kernel.org>
> ---
>  include/net/ip.h | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/include/net/ip.h b/include/net/ip.h
> index b09c48d862cc..1262011d00b8 100644
> --- a/include/net/ip.h
> +++ b/include/net/ip.h
> @@ -442,6 +442,10 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
>             !forwarding)
>                 return dst_mtu(dst);
>
> +       /* 'forwarding = true' case should always honour route mtu */
> +       unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
> +       if (mtu) return mtu;
> +
>         return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU);
>  }
>
> --
> 2.28.0.681.g6f77f65b4e-goog

Eh, what I get for last minute removal of 'if (forwarding) {}' wrapper.