* IPv4 / IPv6 over IPv4 IPsec tunnel: setting the DF bit
@ 2014-01-30 12:25 Simon Schneider
2014-01-30 14:21 ` Hannes Frederic Sowa
0 siblings, 1 reply; 6+ messages in thread
From: Simon Schneider @ 2014-01-30 12:25 UTC (permalink / raw)
To: netdev
Hi,
for the scenarios
- IPv4 over IPv4 IPsec tunnel
- IPv6 over IPv4 IPsec tunnel
I wonder how the DF bit of the outer (encrypted) packet is set.
There are generally three options:
- DF bit always 0
- DF bit always 1
- DF bit copied from inner packet
(the last case is obviously not applicable for the IPv6 case, as the IPv6 header does not have a DF bit).
How is this done in Linux?
When investigating, I stumbled over defines named TNL_F_DF_INHERIT / TNL_F_DF_DEFAULT.
Are these still supported?
Is it possible to configure the behavior at runtime or just at compile time?
I would appreciate very much if someone could give an overview on this!
best regards, Simon
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: IPv4 / IPv6 over IPv4 IPsec tunnel: setting the DF bit
2014-01-30 12:25 IPv4 / IPv6 over IPv4 IPsec tunnel: setting the DF bit Simon Schneider
@ 2014-01-30 14:21 ` Hannes Frederic Sowa
2014-01-30 15:26 ` Aw: " Simon Schneider
0 siblings, 1 reply; 6+ messages in thread
From: Hannes Frederic Sowa @ 2014-01-30 14:21 UTC (permalink / raw)
To: Simon Schneider; +Cc: netdev
On Thu, Jan 30, 2014 at 01:25:10PM +0100, Simon Schneider wrote:
> Hi,
> for the scenarios
> - IPv4 over IPv4 IPsec tunnel
> - IPv6 over IPv4 IPsec tunnel
>
> I wonder how the DF bit of the outer (encrypted) packet is set.
>
> There are generally three options:
> - DF bit always 0
> - DF bit always 1
> - DF bit copied from inner packet
There is a pmtudisc knob on ip tunnel ... to force DF bit on outgoing packets,
but DF bit should get copied from inner packet up to tunnel header in every
case.
Greetings,
Hannes
^ permalink raw reply [flat|nested] 6+ messages in thread
* Aw: Re: IPv4 / IPv6 over IPv4 IPsec tunnel: setting the DF bit
2014-01-30 14:21 ` Hannes Frederic Sowa
@ 2014-01-30 15:26 ` Simon Schneider
2014-01-30 15:59 ` Hannes Frederic Sowa
0 siblings, 1 reply; 6+ messages in thread
From: Simon Schneider @ 2014-01-30 15:26 UTC (permalink / raw)
To: Hannes Frederic Sowa; +Cc: netdev
Hi Hannes,
thanks once again for the quick reply.
Quickly checked the ip manpage. I'm clear about the case where pmtudisc is in effect (default) - the DF bit must be TRUE in this case, for PMTUD to work.
Not sure what you meant by:
"but DF bit should get copied from inner packet up to tunnel header in every
case"
Do you mean the nopmtudisc case?
Also, IPv6 must be different then - there's no DF bit to be copied.
Could you please clarify?
best regards, Simon
Gesendet: Donnerstag, 30. Januar 2014 um 15:21 Uhr
Von: "Hannes Frederic Sowa" <hannes@stressinduktion.org>
An: "Simon Schneider" <simon-schneider@gmx.net>
Cc: netdev@vger.kernel.org
Betreff: Re: IPv4 / IPv6 over IPv4 IPsec tunnel: setting the DF bit
On Thu, Jan 30, 2014 at 01:25:10PM +0100, Simon Schneider wrote:
> Hi,
> for the scenarios
> - IPv4 over IPv4 IPsec tunnel
> - IPv6 over IPv4 IPsec tunnel
>
> I wonder how the DF bit of the outer (encrypted) packet is set.
>
> There are generally three options:
> - DF bit always 0
> - DF bit always 1
> - DF bit copied from inner packet
There is a pmtudisc knob on ip tunnel ... to force DF bit on outgoing packets,
but DF bit should get copied from inner packet up to tunnel header in every
case.
Greetings,
Hannes
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Re: IPv4 / IPv6 over IPv4 IPsec tunnel: setting the DF bit
2014-01-30 15:26 ` Aw: " Simon Schneider
@ 2014-01-30 15:59 ` Hannes Frederic Sowa
2014-01-31 8:27 ` Aw: " Simon Schneider
0 siblings, 1 reply; 6+ messages in thread
From: Hannes Frederic Sowa @ 2014-01-30 15:59 UTC (permalink / raw)
To: Simon Schneider; +Cc: netdev
On Thu, Jan 30, 2014 at 04:26:24PM +0100, Simon Schneider wrote:
> Hi Hannes,
> thanks once again for the quick reply.
>
> Quickly checked the ip manpage. I'm clear about the case where pmtudisc is in effect (default) - the DF bit must be TRUE in this case, for PMTUD to work.
>
> Not sure what you meant by:
>
> "but DF bit should get copied from inner packet up to tunnel header in every
> case"
>
> Do you mean the nopmtudisc case?
Exactly. In nopmtudisc mode the flag is set based on the inner protocols df
bit, default cleared. In pmtudisc mode the DF-flag is always set.
> Also, IPv6 must be different then - there's no DF bit to be copied.
If packet cannot traverse a router frag_needed is returned, tunnel
endpoint relays the icmp info to the original sender and it should update
its pmtu. There is no way to fragment the packet mid-path.
Also IPv6 tunnel endpoint do not fragment the tunnel packets while
encapsulating.
ipsec mode tunnel is allowed to fragment the packets while encapsulation.
> Could you please clarify?
Hope I did. ;)
Greetings,
Hannes
^ permalink raw reply [flat|nested] 6+ messages in thread
* Aw: Re: Re: IPv4 / IPv6 over IPv4 IPsec tunnel: setting the DF bit
2014-01-30 15:59 ` Hannes Frederic Sowa
@ 2014-01-31 8:27 ` Simon Schneider
2014-01-31 15:01 ` Hannes Frederic Sowa
0 siblings, 1 reply; 6+ messages in thread
From: Simon Schneider @ 2014-01-31 8:27 UTC (permalink / raw)
To: Hannes Frederic Sowa; +Cc: netdev
<resending in text format>
Hi Hannes,
thanks.
I think your IPv6 related statements are for a IPv6-over-IPv6 case.
However, I'm especially after the IPv6-over-IPv4 case.
In that case, you cannot copy the DF bit from the inner IPv6 packet.
But you still have the option to set or not set the DF bit in the IPv4 outer packet.
How is that decided?
best regards, Simon
Gesendet: Donnerstag, 30. Januar 2014 um 16:59 Uhr
Von: "Hannes Frederic Sowa" <hannes@stressinduktion.org>
An: "Simon Schneider" <simon-schneider@gmx.net>
Cc: netdev@vger.kernel.org
Betreff: Re: Re: IPv4 / IPv6 over IPv4 IPsec tunnel: setting the DF bit
On Thu, Jan 30, 2014 at 04:26:24PM +0100, Simon Schneider wrote:
> Hi Hannes,
> thanks once again for the quick reply.
>
> Quickly checked the ip manpage. I'm clear about the case where pmtudisc is in effect (default) - the DF bit must be TRUE in this case, for PMTUD to work.
>
> Not sure what you meant by:
>
> "but DF bit should get copied from inner packet up to tunnel header in every
> case"
>
> Do you mean the nopmtudisc case?
Exactly. In nopmtudisc mode the flag is set based on the inner protocols df
bit, default cleared. In pmtudisc mode the DF-flag is always set.
> Also, IPv6 must be different then - there's no DF bit to be copied.
If packet cannot traverse a router frag_needed is returned, tunnel
endpoint relays the icmp info to the original sender and it should update
its pmtu. There is no way to fragment the packet mid-path.
Also IPv6 tunnel endpoint do not fragment the tunnel packets while
encapsulating.
ipsec mode tunnel is allowed to fragment the packets while encapsulation.
> Could you please clarify?
Hope I did. ;)
Greetings,
Hannes
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Re: Re: IPv4 / IPv6 over IPv4 IPsec tunnel: setting the DF bit
2014-01-31 8:27 ` Aw: " Simon Schneider
@ 2014-01-31 15:01 ` Hannes Frederic Sowa
0 siblings, 0 replies; 6+ messages in thread
From: Hannes Frederic Sowa @ 2014-01-31 15:01 UTC (permalink / raw)
To: Simon Schneider; +Cc: netdev
On Fri, Jan 31, 2014 at 09:27:27AM +0100, Simon Schneider wrote:
> I think your IPv6 related statements are for a IPv6-over-IPv6 case.
>
> However, I'm especially after the IPv6-over-IPv4 case.
>
> In that case, you cannot copy the DF bit from the inner IPv6 packet.
>
> But you still have the option to set or not set the DF bit in the IPv4 outer packet.
>
> How is that decided?
Basically only pmtudisc setting is cruical then. So no DF-bit if nopmtudisc
and DF-bit if pmtudisc.
Greetings,
Hannes
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2014-01-31 15:01 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-01-30 12:25 IPv4 / IPv6 over IPv4 IPsec tunnel: setting the DF bit Simon Schneider
2014-01-30 14:21 ` Hannes Frederic Sowa
2014-01-30 15:26 ` Aw: " Simon Schneider
2014-01-30 15:59 ` Hannes Frederic Sowa
2014-01-31 8:27 ` Aw: " Simon Schneider
2014-01-31 15:01 ` Hannes Frederic Sowa
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox