Re: IPv4 tunnels: why IP-IP and SIT enforce DF bit, but GRE does not?

[Konstantin Shemyak <konstantin@shemyak.com>]

On 01.12.2015 12:15, Hannes Frederic Sowa wrote:
> Hello,
>
> On Thu, Nov 26, 2015, at 19:28, Konstantin Shemyak wrote:
>> The kernel has taken the decision to always enforce DF bit on IPv4
>> tunnels, which have fixed (not inherited) TTL (e.g.
>> net/ipv4/ipip.c:ipip_tunnel_ioctl()). Commment by Alexey Kuznetsov in
>> the head of ip_gre.c explains that the reason is attempting to avoid
>> network loops.
>>
>> But the commit c54419321455631 removed this enforcing from GRE tunnels,
>> not changing this behavior for IP-IP (net/ipv4/ipip.c) and SIT
>> (net/ipv6/sit.c).
>>
>> It can be discussed whether such enforcing of DF bit is exactly the
>> desired behavior, but shouldn't it at least be identical across IPv4
>> tunnels?
>
> Very simple, I would like to see DF bit being enforced in case we have a
> static TTL. Parvin, any reasons you removed this code? It is currently
> the only way to make sure the network does not kill itself in an endless
> loop on configuration mistakes.

This solution does not completely eliminate all network loops, as there 
may be other routers in the loop which do not set the DF bit. But it is 
true that this behavior is "we did all we could".
My point was not to question its feasibility, but to make it similar 
across GRE, IP-IP and SIT tunnels.

Konstantin.