Re: [PATCH -next] net: preserve geometry of fragment sizes when forwarding

[Jay Vosburgh <jay.vosburgh@canonical.com>]

Florian Westphal <fw@strlen.de> wrote:
[...]
> cons: doesn't resolve hypothetical(?) router edge cases:
>   #1. if we'd receive e.g. fragment size 1000 and fragment size
>   200, where both fragments have DF bit set, we will currently
>   send a single 1200 byte DF packet, if outdevice has mtu >= 1200.
>
>   This is because ip_finish_output() only fragments if skb->len > mtu.
>
>   #2 iff we do refragment (e.g. out mtu is 1000), we re-create fragments
>   of size 1000 and 200, but DF bit gets lost in the process.
>
>Neither seems to be a big problem, #2 doesn't break end-to-end connectivity,
>and #1 doesn't seem to happen in practice; else we should have seen
>bug reports by now.  However, I do feel uneasy about it and think we should
>fix it.

	FWIW, I've seen Openstack-based network topologies with local
customizations to take advantage of #1 to deliberately avoid
refragmentation on bridge egress.  In this case, the bridge egress port
is a veth device, and the bridge-side veth mtu is set higher than the
veth peer's mtu, which is in a container.  The veth driver does not
check mtu on transmit, so this "works."

	-J

---
	-Jay Vosburgh, jay.vosburgh@canonical.com