From: Steffen Klassert <steffen.klassert@secunet.com>
To: Li Wei <lw@cn.fujitsu.com>
Cc: netdev <netdev@vger.kernel.org>
Subject: Re: Question with commit 299b0767(ipv6: Fix IPsec slowpath fragmentation problem)
Date: Wed, 15 Feb 2012 11:40:21 +0100 [thread overview]
Message-ID: <20120215104021.GC31660@secunet.com> (raw)
In-Reply-To: <4F3B57F4.10106@cn.fujitsu.com>
On Wed, Feb 15, 2012 at 03:00:04PM +0800, Li Wei wrote:
>
> Hi Steffen,
>
> Thank you for your reply!
>
> I see in your patch that you use the "mtu" of &rt->dst (which taken IPSec
> into account) instead of rt->dst.path, but the "exthdrlen" and "dst_exthdrlen"
> things process IPSec again. Does some duplication there?
>
> After reverted the patch and put some "printk" things in the slow_path of
> ip6_fragment(), setup IPSec transport mode between two hosts, when sending
> some echo request which exceeds the MTU, I don't see any "printk" in slow_path
> outputed. Could you tell me how to reproduce the slow_path things?
>
Ok, I see what's going on. The slowpath fragmentation problem appeared
in tunnel mode. This is because commit ad0081e43a
"ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed"
changed tunnel mode to do fragmentation before the transformation
while transport mode still does fragmentation after transformation.
Now, tunnel mode needs IPsec headers and trailer for all fragments,
while on transport mode it is sufficient to add the headers to the
first fragment and the trailer to the last.
Not quite sure what to do here. We would have the information
to check for tunnel/transport mode when we calculate the packet
lenght in ip6_append_data(), but it would look quite ugly to
search through the xfrm state bundle to figure out which mode
this is using.
next prev parent reply other threads:[~2012-02-15 10:40 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-02-13 8:10 Question with commit 299b0767(ipv6: Fix IPsec slowpath fragmentation problem) Li Wei
2012-02-14 11:04 ` Steffen Klassert
2012-02-15 7:00 ` Li Wei
2012-02-15 10:40 ` Steffen Klassert [this message]
2012-05-14 3:21 ` [PATCH] ipv6: fix incorrect ipsec transport mode fragment Gao feng
2012-05-14 13:05 ` Steffen Klassert
2012-05-14 22:41 ` David Miller
2012-05-17 7:42 ` Gao feng
2012-05-17 8:48 ` David Miller
2012-05-15 3:44 ` Gao feng
2012-05-15 11:48 ` Steffen Klassert
2012-05-16 2:59 ` Gao feng
2012-05-26 9:00 ` Gao feng
2012-05-26 11:29 ` Gao feng
2012-05-26 11:30 ` [PATCH v2] ipv6: fix incorrect ipsec fragment Gao feng
2012-05-27 5:12 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120215104021.GC31660@secunet.com \
--to=steffen.klassert@secunet.com \
--cc=lw@cn.fujitsu.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).