From mboxrd@z Thu Jan 1 00:00:00 1970 From: Philip Prindeville Subject: Re: [PATCH net-next] net: ipv4: Add ability to have GRE ignore DF bit in IPv4 payloads Date: Tue, 7 Jun 2016 16:28:18 -0600 Message-ID: <57574A82.2010607@redfish-solutions.com> References: <20160607194846.11494-1-philipp@redfish-solutions.com> <1465331022.134529.630880921.787BED73@webmail.messagingengine.com> <575731A8.1040303@redfish-solutions.com> <11871c8f-3643-0b08-8187-5ed82e21aaa8@stressinduktion.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Cc: Stephen Hemminger To: Hannes Frederic Sowa , netdev@vger.kernel.org Return-path: Received: from mail.redfish-solutions.com ([66.232.79.143]:55754 "EHLO mail.redfish-solutions.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933659AbcFGW2X (ORCPT ); Tue, 7 Jun 2016 18:28:23 -0400 In-Reply-To: <11871c8f-3643-0b08-8187-5ed82e21aaa8@stressinduktion.org> Sender: netdev-owner@vger.kernel.org List-ID: On 06/07/2016 04:23 PM, Hannes Frederic Sowa wrote: > On 07.06.2016 22:42, Philip Prindeville wrote: >> On 06/07/2016 02:23 PM, Hannes Frederic Sowa wrote: >>> On Tue, Jun 7, 2016, at 21:48, Philip Prindeville wrote: >>>> static struct rtnl_link_ops ipgre_link_ops __read_mostly = { >>>> diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c >>>> index d8f5e0a..95649eb 100644 >>>> --- a/net/ipv4/ip_tunnel.c >>>> +++ b/net/ipv4/ip_tunnel.c >>>> @@ -682,7 +682,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct >>>> net_device *dev, >>>> } >>>> df = tnl_params->frag_off; >>>> - if (skb->protocol == htons(ETH_P_IP)) >>>> + if (skb->protocol == htons(ETH_P_IP) && !tunnel->ignore_df) >>>> df |= (inner_iph->frag_off&htons(IP_DF)); >>>> max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct >>>> iphdr) >>> Is still enforce that we inherit the ttl from the inner header to the >>> outer header if we don't set df bit? >>> >>> Thanks, >>> Hannes >> That's correct. That happens a few lines above and we don't change that >> behavior with this patch. > It should be discouraged to use this feature, but I have to admit that I > already used stripping of DF bit, too. > > Acked-by: Hannes Frederic Sowa > > Thanks, > Hannes Yeah, it's admittedly a kludge to get around broken customer firewalls which are discarding ICMP's they have no business filtering. It's the "least ugly workaround" in this scenario. If you have control over the offending firewalls, it's easier (and better) to fix them than configuring this option... but sometimes you have to put up with other people having broken equipment on your network. -Philip