* [PATCH ipsec 0/2] vti(6): fix ipv4 pmtu check to honor ip header df
@ 2021-02-26 21:35 Eyal Birger
2021-02-26 21:35 ` [PATCH ipsec 1/2] vti: " Eyal Birger
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Eyal Birger @ 2021-02-26 21:35 UTC (permalink / raw)
To: steffen.klassert, herbert, davem, kuba
Cc: netdev, bram-yvahk, sd, Eyal Birger
This series aligns vti(6) handling of non-df IPv4 packets exceeding
the size of the tunnel MTU to avoid sending "Frag needed" and instead
fragment the packets after encapsulation.
Eyal Birger (2):
vti: fix ipv4 pmtu check to honor ip header df
vti6: fix ipv4 pmtu check to honor ip header df
net/ipv4/ip_vti.c | 6 ++++--
net/ipv6/ip6_vti.c | 6 ++++--
2 files changed, 8 insertions(+), 4 deletions(-)
--
2.25.1
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH ipsec 1/2] vti: fix ipv4 pmtu check to honor ip header df
2021-02-26 21:35 [PATCH ipsec 0/2] vti(6): fix ipv4 pmtu check to honor ip header df Eyal Birger
@ 2021-02-26 21:35 ` Eyal Birger
2021-02-26 21:35 ` [PATCH ipsec 2/2] vti6: " Eyal Birger
2021-03-02 9:32 ` [PATCH ipsec 0/2] vti(6): " Sabrina Dubroca
2 siblings, 0 replies; 5+ messages in thread
From: Eyal Birger @ 2021-02-26 21:35 UTC (permalink / raw)
To: steffen.klassert, herbert, davem, kuba
Cc: netdev, bram-yvahk, sd, Eyal Birger
Frag needed should only be sent if the header enables DF.
This fix allows packets larger than MTU to pass the vti interface
and be fragmented after encapsulation, aligning behavior with
non-vti xfrm.
Fixes: d6af1a31cc72 ("vti: Add pmtu handling to vti_xmit.")
Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
---
net/ipv4/ip_vti.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index abc171e79d3e..613741384490 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -218,7 +218,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
}
if (dst->flags & DST_XFRM_QUEUE)
- goto queued;
+ goto xmit;
if (!vti_state_check(dst->xfrm, parms->iph.daddr, parms->iph.saddr)) {
dev->stats.tx_carrier_errors++;
@@ -238,6 +238,8 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
if (skb->len > mtu) {
skb_dst_update_pmtu_no_confirm(skb, mtu);
if (skb->protocol == htons(ETH_P_IP)) {
+ if (!(ip_hdr(skb)->frag_off & htons(IP_DF)))
+ goto xmit;
icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
htonl(mtu));
} else {
@@ -251,7 +253,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
goto tx_error;
}
-queued:
+xmit:
skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(dev)));
skb_dst_set(skb, dst);
skb->dev = skb_dst(skb)->dev;
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH ipsec 2/2] vti6: fix ipv4 pmtu check to honor ip header df
2021-02-26 21:35 [PATCH ipsec 0/2] vti(6): fix ipv4 pmtu check to honor ip header df Eyal Birger
2021-02-26 21:35 ` [PATCH ipsec 1/2] vti: " Eyal Birger
@ 2021-02-26 21:35 ` Eyal Birger
2021-03-02 9:32 ` [PATCH ipsec 0/2] vti(6): " Sabrina Dubroca
2 siblings, 0 replies; 5+ messages in thread
From: Eyal Birger @ 2021-02-26 21:35 UTC (permalink / raw)
To: steffen.klassert, herbert, davem, kuba
Cc: netdev, bram-yvahk, sd, Eyal Birger
Frag needed should only be sent if the header enables DF.
This fix allows IPv4 packets larger than MTU to pass the vti6 interface
and be fragmented after encapsulation, aligning behavior with
non-vti6 xfrm.
Fixes: ccd740cbc6e0 ("vti6: Add pmtu handling to vti6_xmit.")
Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
---
net/ipv6/ip6_vti.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 0225fd694192..2f0be5ac021c 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -494,7 +494,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
}
if (dst->flags & DST_XFRM_QUEUE)
- goto queued;
+ goto xmit;
x = dst->xfrm;
if (!vti6_state_check(x, &t->parms.raddr, &t->parms.laddr))
@@ -523,6 +523,8 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
} else {
+ if (!(ip_hdr(skb)->frag_off & htons(IP_DF)))
+ goto xmit;
icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
htonl(mtu));
}
@@ -531,7 +533,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
goto tx_err_dst_release;
}
-queued:
+xmit:
skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
skb_dst_set(skb, dst);
skb->dev = skb_dst(skb)->dev;
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH ipsec 0/2] vti(6): fix ipv4 pmtu check to honor ip header df
2021-02-26 21:35 [PATCH ipsec 0/2] vti(6): fix ipv4 pmtu check to honor ip header df Eyal Birger
2021-02-26 21:35 ` [PATCH ipsec 1/2] vti: " Eyal Birger
2021-02-26 21:35 ` [PATCH ipsec 2/2] vti6: " Eyal Birger
@ 2021-03-02 9:32 ` Sabrina Dubroca
2021-03-03 8:30 ` Steffen Klassert
2 siblings, 1 reply; 5+ messages in thread
From: Sabrina Dubroca @ 2021-03-02 9:32 UTC (permalink / raw)
To: Eyal Birger; +Cc: steffen.klassert, herbert, davem, kuba, netdev, bram-yvahk
2021-02-26, 23:35:04 +0200, Eyal Birger wrote:
> This series aligns vti(6) handling of non-df IPv4 packets exceeding
> the size of the tunnel MTU to avoid sending "Frag needed" and instead
> fragment the packets after encapsulation.
>
> Eyal Birger (2):
> vti: fix ipv4 pmtu check to honor ip header df
> vti6: fix ipv4 pmtu check to honor ip header df
Thanks Eyal.
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Steffen, that's going to conflict with commit 4372339efc06 ("net:
always use icmp{,v6}_ndo_send from ndo_start_xmit") from net.
--
Sabrina
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH ipsec 0/2] vti(6): fix ipv4 pmtu check to honor ip header df
2021-03-02 9:32 ` [PATCH ipsec 0/2] vti(6): " Sabrina Dubroca
@ 2021-03-03 8:30 ` Steffen Klassert
0 siblings, 0 replies; 5+ messages in thread
From: Steffen Klassert @ 2021-03-03 8:30 UTC (permalink / raw)
To: Sabrina Dubroca; +Cc: Eyal Birger, herbert, davem, kuba, netdev, bram-yvahk
On Tue, Mar 02, 2021 at 10:32:13AM +0100, Sabrina Dubroca wrote:
> 2021-02-26, 23:35:04 +0200, Eyal Birger wrote:
> > This series aligns vti(6) handling of non-df IPv4 packets exceeding
> > the size of the tunnel MTU to avoid sending "Frag needed" and instead
> > fragment the packets after encapsulation.
> >
> > Eyal Birger (2):
> > vti: fix ipv4 pmtu check to honor ip header df
> > vti6: fix ipv4 pmtu check to honor ip header df
>
> Thanks Eyal.
> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
>
> Steffen, that's going to conflict with commit 4372339efc06 ("net:
> always use icmp{,v6}_ndo_send from ndo_start_xmit") from net.
Applied, thanks everyone!
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-03-04 0:13 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-26 21:35 [PATCH ipsec 0/2] vti(6): fix ipv4 pmtu check to honor ip header df Eyal Birger
2021-02-26 21:35 ` [PATCH ipsec 1/2] vti: " Eyal Birger
2021-02-26 21:35 ` [PATCH ipsec 2/2] vti6: " Eyal Birger
2021-03-02 9:32 ` [PATCH ipsec 0/2] vti(6): " Sabrina Dubroca
2021-03-03 8:30 ` Steffen Klassert
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).