From: Christian Perle <christian.perle@secunet.com>
To: Florian Westphal <fw@strlen.de>
Cc: <netdev@vger.kernel.org>, <steffen.klassert@secunet.com>,
<netfilter-devel@vger.kernel.org>
Subject: Re: [PATCH net 3/3] net: ip: always refragment ip defragmented packets
Date: Thu, 7 Jan 2021 08:52:50 +0100 [thread overview]
Message-ID: <20210107075250.GA16010@cell> (raw)
In-Reply-To: <20210105231523.622-4-fw@strlen.de>
Hello Florian,
On Wed, Jan 06, 2021 at 00:15:23 +0100, Florian Westphal wrote:
> Force refragmentation as per original sizes unconditionally so ip tunnel
> will encapsulate the fragments instead.
[...]
> diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
> index 89fff5f59eea..2ed0b01f72f0 100644
> --- a/net/ipv4/ip_output.c
> +++ b/net/ipv4/ip_output.c
> @@ -302,7 +302,7 @@ static int __ip_finish_output(struct net *net, struct sock *sk, struct sk_buff *
> if (skb_is_gso(skb))
> return ip_finish_output_gso(net, sk, skb, mtu);
>
> - if (skb->len > mtu || (IPCB(skb)->flags & IPSKB_FRAG_PMTU))
> + if (skb->len > mtu || IPCB(skb)->frag_max_size)
> return ip_fragment(net, sk, skb, mtu, ip_finish_output2);
>
> return ip_finish_output2(net, sk, skb);
> --
> 2.26.2
Did some tests yesterday and I can confirm that this patch fixes the
problem for both IPIP tunnel and XFRM tunnel interfaces.
Thanks for the fix!
Christian Perle
--
Christian Perle
Senior Berater / Senior Consultant
Netzwerk- und Client-Sicherheit / Network & Client Security
Öffentliche Auftraggeber / Public Authorities
secunet Security Networks AG
Tel.: +49 201 54 54-3533, Fax: +49 201 54 54-1323
E-Mail: christian.perle@secunet.com
Ammonstraße 74, 01067 Dresden, Deutschland
www.secunet.com
secunet Security Networks AG
Sitz: Kurfürstenstraße 58, 45138 Essen, Deutschland
Amtsgericht Essen HRB 13615
Vorstand: Axel Deininger (Vors.), Torsten Henn, Dr. Kai Martius, Thomas Pleines
Aufsichtsratsvorsitzender: Ralf Wintergerst
next prev parent reply other threads:[~2021-01-07 7:54 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-05 12:12 BUG: IPv4 conntrack reassembles forwarded packets Christian Perle
2021-01-05 23:15 ` [PATCH net 0/3] net: fix netfilter defrag/ip tunnel pmtu blackhole Florian Westphal
2021-01-05 23:15 ` [PATCH net 1/3] selftests: netfilter: add selftest for ipip pmtu discovery with enabled connection tracking Florian Westphal
2021-01-05 23:15 ` [PATCH net 2/3] net: fix pmtu check in nopmtudisc mode Florian Westphal
2021-01-05 23:15 ` [PATCH net 3/3] net: ip: always refragment ip defragmented packets Florian Westphal
2021-01-07 7:52 ` Christian Perle [this message]
2021-01-07 22:14 ` [PATCH net 0/3] net: fix netfilter defrag/ip tunnel pmtu blackhole Pablo Neira Ayuso
2021-01-07 22:45 ` Jakub Kicinski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210107075250.GA16010@cell \
--to=christian.perle@secunet.com \
--cc=fw@strlen.de \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=steffen.klassert@secunet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).