Possible IPv6 fragmentation/pmtud bug

Possible IPv6 fragmentation/pmtud bug

[Templin, Fred L]

Hi,

I have the following test network configuration (all linux nodes
running the 3.10.17 kernel):


h1 <-----------> r1 <-----------> r2 <-----------> h2
   8000 MTU link    4000 MTU link    8000 MTU link

When host h1 ping6's host h2, routers r1 and r2 forward the ICMPv6
echo request/reply packets as expected. But, when I set a ping6
packet size that is larger than the router-to-router link MTU:

  h1# ping6 -s 5000 h2

router r1 does NOT send an ICMPv6 Packet Too Big message back
to host h1 but rather fragments the ICMPv6 echo request packets
itself before forwarding on to router r2 then ultimately host h1.
The ping6's still succeed because of IPv6 fragmentation, but it
is *router r1* that is doing the fragmentation instead of host h1.

This seems to be related to the setting of the "skb->local_df" flag,
which should only be set for locally-generated packets; not for
packets that are being forwarded by a router. Does anyone have any
idea as to why my router is performing fragmentation when it forwards
an ICMPv6 packet?

Thanks - Fred
fred.l.templin@boeing.com

RE: Possible IPv6 fragmentation/pmtud bug

[Templin, Fred L]

Another clue that I should have mentioned in my initial message; the
"hosts", "routers" and "links" are not physical nodes but rather
network namespace virtual nodes running within a single linux 3.10.17
emulation server. Could there be some sort of weird "cross-talk"
between VMs that is making the router believe it is a host?

Thanks - Fred
fred.l.templin@boeing.com 

> -----Original Message-----
> From: netdev-owner@vger.kernel.org [mailto:netdev-owner@vger.kernel.org] On Behalf Of Templin, Fred L
> Sent: Thursday, December 05, 2013 11:40 AM
> To: netdev@vger.kernel.org
> Subject: Possible IPv6 fragmentation/pmtud bug
> 
> Hi,
> 
> I have the following test network configuration (all linux nodes
> running the 3.10.17 kernel):
> 
> 
> h1 <-----------> r1 <-----------> r2 <-----------> h2
>    8000 MTU link    4000 MTU link    8000 MTU link
> 
> When host h1 ping6's host h2, routers r1 and r2 forward the ICMPv6
> echo request/reply packets as expected. But, when I set a ping6
> packet size that is larger than the router-to-router link MTU:
> 
>   h1# ping6 -s 5000 h2
> 
> router r1 does NOT send an ICMPv6 Packet Too Big message back
> to host h1 but rather fragments the ICMPv6 echo request packets
> itself before forwarding on to router r2 then ultimately host h1.
> The ping6's still succeed because of IPv6 fragmentation, but it
> is *router r1* that is doing the fragmentation instead of host h1.
> 
> This seems to be related to the setting of the "skb->local_df" flag,
> which should only be set for locally-generated packets; not for
> packets that are being forwarded by a router. Does anyone have any
> idea as to why my router is performing fragmentation when it forwards
> an ICMPv6 packet?
> 
> Thanks - Fred
> fred.l.templin@boeing.com
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Possible IPv6 fragmentation/pmtud bug

[Hannes Frederic Sowa]

On Thu, Dec 05, 2013 at 08:13:25PM +0000, Templin, Fred L wrote:
> Another clue that I should have mentioned in my initial message; the
> "hosts", "routers" and "links" are not physical nodes but rather
> network namespace virtual nodes running within a single linux 3.10.17
> emulation server. Could there be some sort of weird "cross-talk"
> between VMs that is making the router believe it is a host?

That is probable. With a quick test I could not reproduce it. I guess we don't
reset skb->local_df after creation. I'll check it out.

Thanks for the report,

  Hannes

[PATCH] net: clear local_df when passing skb between namespaces

[Hannes Frederic Sowa]

We must clear local_df when passing the skb between namespaces as the
packet is not local to the new namespace any more and thus may not get
fragmented by local rules. Fred Templin noticed that other namespaces
do fragment IPv6 packets while forwarding. Instead they should have send
back a PTB.

The same problem should be present when forwarding DF-IPv4 packets
between namespaces.

Reported-by: Templin, Fred L <Fred.L.Templin@boeing.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
---
 net/core/skbuff.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 2718fed..06e72d3 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3584,6 +3584,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
 	skb->tstamp.tv64 = 0;
 	skb->pkt_type = PACKET_HOST;
 	skb->skb_iif = 0;
+	skb->local_df = 0;
 	skb_dst_drop(skb);
 	skb->mark = 0;
 	secpath_reset(skb);
-- 
1.8.3.1

RE: [PATCH] net: clear local_df when passing skb between namespaces

[Templin, Fred L]

Concur - testing on an earlier kernel version shows that clearing
local_df solves the problem.

Fred

> -----Original Message-----
> From: Hannes Frederic Sowa [mailto:hannes@stressinduktion.org]
> Sent: Thursday, December 05, 2013 2:29 PM
> To: Templin, Fred L; netdev@vger.kernel.org
> Subject: [PATCH] net: clear local_df when passing skb between namespaces
> 
> We must clear local_df when passing the skb between namespaces as the
> packet is not local to the new namespace any more and thus may not get
> fragmented by local rules. Fred Templin noticed that other namespaces
> do fragment IPv6 packets while forwarding. Instead they should have send
> back a PTB.
> 
> The same problem should be present when forwarding DF-IPv4 packets
> between namespaces.
> 
> Reported-by: Templin, Fred L <Fred.L.Templin@boeing.com>
> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
> ---
>  net/core/skbuff.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index 2718fed..06e72d3 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -3584,6 +3584,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
>  	skb->tstamp.tv64 = 0;
>  	skb->pkt_type = PACKET_HOST;
>  	skb->skb_iif = 0;
> +	skb->local_df = 0;
>  	skb_dst_drop(skb);
>  	skb->mark = 0;
>  	secpath_reset(skb);
> --
> 1.8.3.1

Re: [PATCH] net: clear local_df when passing skb between namespaces

[David Miller]

From: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date: Thu, 5 Dec 2013 23:29:19 +0100

> We must clear local_df when passing the skb between namespaces as the
> packet is not local to the new namespace any more and thus may not get
> fragmented by local rules. Fred Templin noticed that other namespaces
> do fragment IPv6 packets while forwarding. Instead they should have send
> back a PTB.
> 
> The same problem should be present when forwarding DF-IPv4 packets
> between namespaces.
> 
> Reported-by: Templin, Fred L <Fred.L.Templin@boeing.com>
> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>

Applied and queued up for -stable, thanks Hannes.