[PATCH net-next 0/4] ipv6: fix stale transport header of GSO packets with extension headers

[Matt Vollrath <tactii@gmail.com>]

IPv6 input uses transport_header as a cursor over the extension headers:
ip6_rcv_core() sets it just past the fixed header, and each handler
advances it. Forwarding stops after hop-by-hop options, so a forwarded
GSO packet with a destination options or routing header keeps
transport_header at that extension header, in place of the L4 offset
GRO had computed. seg6 inline, rpl and ioam6 inline likewise point it at
the header they insert on output.

Code that runs later reads the extension header as TCP:

- Since commit fe6cc55f3a9a ("net: ip, ipv6: handle gso skbs in
  forwarding path"), ip6_forward()'s MTU check can answer with Packet
  Too Big at the current MTU, and the flow stalls.
- Since commit 7fb4c1967011 ("net: pull headers in
  qdisc_pkt_len_segs_init()"), in v7.1 and 6.12.114,
  __dev_queue_xmit() drops the packet as SKB_BAD_GSO when the bogus
  doff is below 5. Zero padding and SRH segment addresses make that
  common.
- Qdisc length accounting and ndo_features_check() see the wrong
  header lengths.

Rather than make each reader find the L4 header itself, set
transport_header where it goes stale. Patch 1 does it in ip6_forward()
before the MTU check, which every forwarding path reaches, including a
router that processes a routing header and forwards the packet again.
Patches 2-4 restore it after inline insertion on output. The input
paths keep it at the inserted header, where local input parses from.

For these packets, drivers now see the real L4 header in
ndo_features_check(), and in ndo_start_xmit() too for those that are not
CHECKSUM_PARTIAL, such as fraglist GRO. CHECKSUM_PARTIAL packets already
reached ndo_start_xmit() with this value.

Not covered: bridged IPv6 with br_netfilter, where
br_nf_pre_routing_ipv6() does what ip6_rcv_core() does, and GSO
packets that never pass through IPv6 input, such as LRO aggregates
redirected by tc.

Tested on net-next in QEMU with 3 s TCP flows between network
namespaces over veth, forwarded by the host unless noted:

                                        before     after
  dstopts, byte 12 = 0x00 (drop)        1.1 MB     13.9 GB
  dstopts, byte 12 = 0xf0 (PTB loop)    6.2 MB     13.9 GB
  SRH set by an unprivileged sender     5.0 MB     14.4 GB
  SRH with the router as a segment      4.7 MB     11.4 GB
  fraglist GRO, dstopts 0x00            3.8 MB      3.0 GB
  sender's seg6 / rpl / ioam6 inline     65 KB   9.3-11.0 GB

Forwarding without extension headers was unchanged within run-to-run
noise.

Matt Vollrath (4):
  ipv6: fix transport header of forwarded GSO packets
  ipv6: sr: keep transport header after inline SRH insertion
  ipv6: rpl: keep transport header after SRH insertion
  ipv6: ioam: keep transport header after inline insertion

 net/ipv6/ioam6_iptunnel.c |  7 +++++++
 net/ipv6/ip6_output.c     | 17 +++++++++++++++++
 net/ipv6/rpl_iptunnel.c   |  7 +++++++
 net/ipv6/seg6_iptunnel.c  |  8 ++++++++
 4 files changed, 39 insertions(+)


base-commit: 0822d2fe38262e8b55c5ea55c970022bca8dd2a9
-- 
2.43.0