[PATCH ipsec 0/2] vti(6): fix ipv4 pmtu check to honor ip header df

[PATCH ipsec 0/2] vti(6): fix ipv4 pmtu check to honor ip header df

[Eyal Birger]

This series aligns vti(6) handling of non-df IPv4 packets exceeding
the size of the tunnel MTU to avoid sending "Frag needed" and instead
fragment the packets after encapsulation.

Eyal Birger (2):
  vti: fix ipv4 pmtu check to honor ip header df
  vti6: fix ipv4 pmtu check to honor ip header df

 net/ipv4/ip_vti.c  | 6 ++++--
 net/ipv6/ip6_vti.c | 6 ++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

-- 
2.25.1

[PATCH ipsec 1/2] vti: fix ipv4 pmtu check to honor ip header df

[Eyal Birger]

Frag needed should only be sent if the header enables DF.

This fix allows packets larger than MTU to pass the vti interface
and be fragmented after encapsulation, aligning behavior with
non-vti xfrm.

Fixes: d6af1a31cc72 ("vti: Add pmtu handling to vti_xmit.")
Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
---
 net/ipv4/ip_vti.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index abc171e79d3e..613741384490 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -218,7 +218,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
 	}
 
 	if (dst->flags & DST_XFRM_QUEUE)
-		goto queued;
+		goto xmit;
 
 	if (!vti_state_check(dst->xfrm, parms->iph.daddr, parms->iph.saddr)) {
 		dev->stats.tx_carrier_errors++;
@@ -238,6 +238,8 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
 	if (skb->len > mtu) {
 		skb_dst_update_pmtu_no_confirm(skb, mtu);
 		if (skb->protocol == htons(ETH_P_IP)) {
+			if (!(ip_hdr(skb)->frag_off & htons(IP_DF)))
+				goto xmit;
 			icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
 				  htonl(mtu));
 		} else {
@@ -251,7 +253,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
 		goto tx_error;
 	}
 
-queued:
+xmit:
 	skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(dev)));
 	skb_dst_set(skb, dst);
 	skb->dev = skb_dst(skb)->dev;
-- 
2.25.1

[PATCH ipsec 2/2] vti6: fix ipv4 pmtu check to honor ip header df

[Eyal Birger]

Frag needed should only be sent if the header enables DF.

This fix allows IPv4 packets larger than MTU to pass the vti6 interface
and be fragmented after encapsulation, aligning behavior with
non-vti6 xfrm.

Fixes: ccd740cbc6e0 ("vti6: Add pmtu handling to vti6_xmit.")
Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
---
 net/ipv6/ip6_vti.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 0225fd694192..2f0be5ac021c 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -494,7 +494,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 	}
 
 	if (dst->flags & DST_XFRM_QUEUE)
-		goto queued;
+		goto xmit;
 
 	x = dst->xfrm;
 	if (!vti6_state_check(x, &t->parms.raddr, &t->parms.laddr))
@@ -523,6 +523,8 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 
 			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 		} else {
+			if (!(ip_hdr(skb)->frag_off & htons(IP_DF)))
+				goto xmit;
 			icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
 				  htonl(mtu));
 		}
@@ -531,7 +533,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 		goto tx_err_dst_release;
 	}
 
-queued:
+xmit:
 	skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
 	skb_dst_set(skb, dst);
 	skb->dev = skb_dst(skb)->dev;
-- 
2.25.1

Re: [PATCH ipsec 0/2] vti(6): fix ipv4 pmtu check to honor ip header df

[Sabrina Dubroca]

2021-02-26, 23:35:04 +0200, Eyal Birger wrote:
> This series aligns vti(6) handling of non-df IPv4 packets exceeding
> the size of the tunnel MTU to avoid sending "Frag needed" and instead
> fragment the packets after encapsulation.
> 
> Eyal Birger (2):
>   vti: fix ipv4 pmtu check to honor ip header df
>   vti6: fix ipv4 pmtu check to honor ip header df

Thanks Eyal.
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>

Steffen, that's going to conflict with commit 4372339efc06 ("net:
always use icmp{,v6}_ndo_send from ndo_start_xmit") from net.

-- 
Sabrina

Re: [PATCH ipsec 0/2] vti(6): fix ipv4 pmtu check to honor ip header df

[Steffen Klassert]

On Tue, Mar 02, 2021 at 10:32:13AM +0100, Sabrina Dubroca wrote:
> 2021-02-26, 23:35:04 +0200, Eyal Birger wrote:
> > This series aligns vti(6) handling of non-df IPv4 packets exceeding
> > the size of the tunnel MTU to avoid sending "Frag needed" and instead
> > fragment the packets after encapsulation.
> > 
> > Eyal Birger (2):
> >   vti: fix ipv4 pmtu check to honor ip header df
> >   vti6: fix ipv4 pmtu check to honor ip header df
> 
> Thanks Eyal.
> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
> 
> Steffen, that's going to conflict with commit 4372339efc06 ("net:
> always use icmp{,v6}_ndo_send from ndo_start_xmit") from net.

Applied, thanks everyone!