* [PATCH ipsec v2] xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set
@ 2025-12-11 10:30 Antony Antony
2025-12-18 7:26 ` Steffen Klassert
0 siblings, 1 reply; 2+ messages in thread
From: Antony Antony @ 2025-12-11 10:30 UTC (permalink / raw)
To: Steffen Klassert, Herbert Xu, netdev
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Sabrina Dubroca
The XFRM_STATE_NOPMTUDISC flag is only meaningful for output SAs, but
it was being applied regardless of the SA direction when the sysctl
ip_no_pmtu_disc is enabled. This can unintentionally affect input SAs.
Limit setting XFRM_STATE_NOPMTUDISC to output SAs when the SA direction
is configured.
Closes: https://github.com/strongswan/strongswan/issues/2946
Fixes: a4a87fa4e96c ("xfrm: Add Direction to the SA in or out")
Signed-off-by: Antony Antony <antony.antony@secunet.com>
---
v1 -> v2 removed Unrecognized email address: Reported-by: 'https://github.com/roth-m'
---
net/xfrm/xfrm_state.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 9e14e453b55c..98b362d51836 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -3151,6 +3151,7 @@ int __xfrm_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack)
int err;
if (family == AF_INET &&
+ (!x->dir || x->dir == XFRM_SA_DIR_OUT) &&
READ_ONCE(xs_net(x)->ipv4.sysctl_ip_no_pmtu_disc))
x->props.flags |= XFRM_STATE_NOPMTUDISC;
--
2.39.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH ipsec v2] xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set
2025-12-11 10:30 [PATCH ipsec v2] xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set Antony Antony
@ 2025-12-18 7:26 ` Steffen Klassert
0 siblings, 0 replies; 2+ messages in thread
From: Steffen Klassert @ 2025-12-18 7:26 UTC (permalink / raw)
To: Antony Antony
Cc: Herbert Xu, netdev, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Sabrina Dubroca
On Thu, Dec 11, 2025 at 11:30:27AM +0100, Antony Antony wrote:
> The XFRM_STATE_NOPMTUDISC flag is only meaningful for output SAs, but
> it was being applied regardless of the SA direction when the sysctl
> ip_no_pmtu_disc is enabled. This can unintentionally affect input SAs.
>
> Limit setting XFRM_STATE_NOPMTUDISC to output SAs when the SA direction
> is configured.
>
> Closes: https://github.com/strongswan/strongswan/issues/2946
> Fixes: a4a87fa4e96c ("xfrm: Add Direction to the SA in or out")
> Signed-off-by: Antony Antony <antony.antony@secunet.com>
Applied, thanks a lot Antony!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-12-18 7:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-12-11 10:30 [PATCH ipsec v2] xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set Antony Antony
2025-12-18 7:26 ` Steffen Klassert
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).