From: David Ahern <dsahern@gmail.com>
To: Ashwanth Goli <ashwanth@codeaurora.org>, Paolo Abeni <pabeni@redhat.com>
Cc: netdev@vger.kernel.org, maloney@google.com, edumazet@google.com,
netdev-owner@vger.kernel.org
Subject: Re: ip6-in-ip{4,6} ipsec tunnel issues with 1280 MTU
Date: Fri, 27 Apr 2018 08:48:09 -0600 [thread overview]
Message-ID: <b5b26603-199b-66e3-0576-ec4dfab9230f@gmail.com> (raw)
In-Reply-To: <a3e39b94de731f86d2e9ecd8f0230643@codeaurora.org>
On 4/27/18 5:02 AM, Ashwanth Goli wrote:
> On 2018-04-26 17:21, Paolo Abeni wrote:
>> Hi,
>>
>> [fixed CC list]
>>
>> On Wed, 2018-04-25 at 21:43 +0530, Ashwanth Goli wrote:
>>> Hi Pablo,
>>
>> Actually I'm Paolo, but yours is a recurring mistake ;)
>>
>>> I am noticing an issue similar to the one reported by Alexis Perez
>>> [Regression for ip6-in-ip4 IPsec tunnel in 4.14.16]
>>>
>>> In my IPsec setup outer MTU is set to 1280, ip6_setup_cork sees an MTU
>>> less than IPV6_MIN_MTU because of the tunnel headers. -EINVAL is being
>>> returned as a result of the MTU check that got added with below patch.
If you know you are running ipsec over the link why are you setting the
outer MTU to 1280? RFC 2460 suggests the fragmentation of packets for
links with MTU < 1280 should be done below the IPv6 layer:
5. Packet Size Issues
IPv6 requires that every link in the internet have an MTU of 1280
octets or greater. On any link that cannot convey a 1280-octet
packet in one piece, link-specific fragmentation and reassembly must
be provided at a layer below IPv6.
Links that have a configurable MTU (for example, PPP links [RFC-
1661]) must be configured to have an MTU of at least 1280 octets; it
is recommended that they be configured with an MTU of 1500 octets or
greater, to accommodate possible encapsulations (i.e., tunneling)
without incurring IPv6-layer fragmentation.
next prev parent reply other threads:[~2018-04-27 14:48 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <c3a1f2fc545b622bbb362e98313d7eba@codeaurora.org>
2018-04-26 11:51 ` ip6-in-ip{4,6} ipsec tunnel issues with 1280 MTU Paolo Abeni
2018-04-27 11:02 ` Ashwanth Goli
2018-04-27 14:48 ` David Ahern [this message]
2018-04-27 15:44 ` Ashwanth Goli
2018-04-29 1:05 ` David Ahern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b5b26603-199b-66e3-0576-ec4dfab9230f@gmail.com \
--to=dsahern@gmail.com \
--cc=ashwanth@codeaurora.org \
--cc=edumazet@google.com \
--cc=maloney@google.com \
--cc=netdev-owner@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).