linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	Christian Perle <christian.perle@secunet.com>,
	Florian Westphal <fw@strlen.de>,
	Pablo Neira Ayuso <pablo@netfilter.org>,
	Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH 4.19 07/43] net: ip: always refragment ip defragmented packets
Date: Fri, 15 Jan 2021 13:27:37 +0100	[thread overview]
Message-ID: <20210115121957.409613220@linuxfoundation.org> (raw)
In-Reply-To: <20210115121957.037407908@linuxfoundation.org>

From: Florian Westphal <fw@strlen.de>

[ Upstream commit bb4cc1a18856a73f0ff5137df0c2a31f4c50f6cf ]

Conntrack reassembly records the largest fragment size seen in IPCB.
However, when this gets forwarded/transmitted, fragmentation will only
be forced if one of the fragmented packets had the DF bit set.

In that case, a flag in IPCB will force fragmentation even if the
MTU is large enough.

This should work fine, but this breaks with ip tunnels.
Consider client that sends a UDP datagram of size X to another host.

The client fragments the datagram, so two packets, of size y and z, are
sent. DF bit is not set on any of these packets.

Middlebox netfilter reassembles those packets back to single size-X
packet, before routing decision.

packet-size-vs-mtu checks in ip_forward are irrelevant, because DF bit
isn't set.  At output time, ip refragmentation is skipped as well
because x is still smaller than the mtu of the output device.

If ttransmit device is an ip tunnel, the packet size increases to
x+overhead.

Also, tunnel might be configured to force DF bit on outer header.

In this case, packet will be dropped (exceeds MTU) and an ICMP error is
generated back to sender.

But sender already respects the announced MTU, all the packets that
it sent did fit the announced mtu.

Force refragmentation as per original sizes unconditionally so ip tunnel
will encapsulate the fragments instead.

The only other solution I see is to place ip refragmentation in
the ip_tunnel code to handle this case.

Fixes: d6b915e29f4ad ("ip_fragment: don't forward defragmented DF packet")
Reported-by: Christian Perle <christian.perle@secunet.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/ip_output.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -312,7 +312,7 @@ static int ip_finish_output(struct net *
 	if (skb_is_gso(skb))
 		return ip_finish_output_gso(net, sk, skb, mtu);
 
-	if (skb->len > mtu || (IPCB(skb)->flags & IPSKB_FRAG_PMTU))
+	if (skb->len > mtu || IPCB(skb)->frag_max_size)
 		return ip_fragment(net, sk, skb, mtu, ip_finish_output2);
 
 	return ip_finish_output2(net, sk, skb);



  parent reply	other threads:[~2021-01-15 12:33 UTC|newest]

Thread overview: 48+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-15 12:27 [PATCH 4.19 00/43] 4.19.168-rc1 review Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 01/43] net: cdc_ncm: correct overhead in delayed_ndp_size Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 02/43] net: hns3: fix the number of queues actually used by ARQ Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 03/43] net: stmmac: dwmac-sun8i: Balance internal PHY resource references Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 04/43] net: stmmac: dwmac-sun8i: Balance internal PHY power Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 05/43] net: vlan: avoid leaks on register_vlan_dev() failures Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 06/43] net/sonic: Fix some resource leaks in error handling paths Greg Kroah-Hartman
2021-01-15 12:27 ` Greg Kroah-Hartman [this message]
2021-01-15 12:27 ` [PATCH 4.19 08/43] net: fix pmtu check in nopmtudisc mode Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 09/43] net: ipv6: fib: flush exceptions when purging route Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 10/43] chtls: Fix hardware tid leak Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 11/43] chtls: Remove invalid set_tcb call Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 12/43] chtls: Fix panic when route to peer not configured Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 13/43] chtls: Replace skb_dequeue with skb_peek Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 14/43] chtls: Added a check to avoid NULL pointer dereference Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 15/43] chtls: Fix chtls resources release sequence Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 16/43] x86/resctrl: Use an IPI instead of task_work_add() to update PQR_ASSOC MSR Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 17/43] x86/resctrl: Dont move a task to the same resource group Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 18/43] vmlinux.lds.h: Add PGO and AutoFDO input sections Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 19/43] drm/i915: Fix mismatch between misplaced vma check and vma insert Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 20/43] spi: pxa2xx: Fix use-after-free on unbind Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 21/43] iio: imu: st_lsm6dsx: flip irq return logic Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 22/43] iio: imu: st_lsm6dsx: fix edge-trigger interrupts Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 23/43] HID: wacom: Fix memory leakage caused by kfifo_alloc Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 24/43] ARM: OMAP2+: omap_device: fix idling of devices during probe Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 25/43] i2c: sprd: use a specific timeout to avoid system hang up issue Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 26/43] cpufreq: powernow-k8: pass policy rather than use cpufreq_cpu_get() Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 27/43] spi: stm32: FIFO threshold level - fix align packet size Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 28/43] dmaengine: mediatek: mtk-hsdma: Fix a resource leak in the error handling path of the probe function Greg Kroah-Hartman
2021-01-15 12:27 ` [PATCH 4.19 29/43] dmaengine: xilinx_dma: check dma_async_device_register return value Greg Kroah-Hartman
2021-01-15 12:28 ` [PATCH 4.19 30/43] dmaengine: xilinx_dma: fix incompatible param warning in _child_probe() Greg Kroah-Hartman
2021-01-15 12:28 ` [PATCH 4.19 31/43] dmaengine: xilinx_dma: fix mixed_enum_type coverity warning Greg Kroah-Hartman
2021-01-15 12:28 ` [PATCH 4.19 32/43] wil6210: select CONFIG_CRC32 Greg Kroah-Hartman
2021-01-15 12:28 ` [PATCH 4.19 33/43] block: rsxx: " Greg Kroah-Hartman
2021-01-15 12:28 ` [PATCH 4.19 34/43] lightnvm: " Greg Kroah-Hartman
2021-01-15 12:28 ` [PATCH 4.19 35/43] iommu/intel: Fix memleak in intel_irq_remapping_alloc Greg Kroah-Hartman
2021-01-15 12:28 ` [PATCH 4.19 36/43] net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups Greg Kroah-Hartman
2021-01-15 12:28 ` [PATCH 4.19 37/43] net/mlx5e: Fix two double free cases Greg Kroah-Hartman
2021-01-15 12:28 ` [PATCH 4.19 38/43] regmap: debugfs: Fix a memory leak when calling regmap_attach_dev Greg Kroah-Hartman
2021-01-15 12:28 ` [PATCH 4.19 39/43] wan: ds26522: select CONFIG_BITREVERSE Greg Kroah-Hartman
2021-01-15 12:28 ` [PATCH 4.19 40/43] KVM: arm64: Dont access PMCR_EL0 when no PMU is available Greg Kroah-Hartman
2021-01-15 12:28 ` [PATCH 4.19 41/43] block: fix use-after-free in disk_part_iter_next Greg Kroah-Hartman
2021-01-15 12:28 ` [PATCH 4.19 42/43] net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet Greg Kroah-Hartman
2021-01-15 12:28 ` [PATCH 4.19 43/43] regmap: debugfs: Fix a reversed if statement in regmap_debugfs_init() Greg Kroah-Hartman
2021-01-15 21:14 ` [PATCH 4.19 00/43] 4.19.168-rc1 review Shuah Khan
2021-01-15 21:18 ` Guenter Roeck
2021-01-16  6:03 ` Naresh Kamboju
2021-01-16  7:58 ` Pavel Machek

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210115121957.409613220@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=christian.perle@secunet.com \
    --cc=fw@strlen.de \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).