ipv6: remove min MTU check for ipsec tunnels

PATCH Superseded Ashwanth Goli 2 participants 2 messages May 10, 2018

Subsystems (3)

Networking Network drivers IPv4/IPv6

lore

Share & tools

lore

Ashwanth Goli

author

2018-05-10 16:48 UTC #0 lore raw

PATCH v2 1/1 ipv6: remove min MTU check for ipsec tunnels

With 749439bfac "fix udpv6 sendmsg crash caused by too small MTU" ipsec tunnels that report a MTU less than IPV6_MIN_MTU are broken even for packets that are smaller than IPV6_MIN_MTU.

According to rfc2473#section-7.1

if the original IPv6 packet is equal or smaller than the IPv6 minimum link MTU, the tunnel entry-point node encapsulates the original packet, and subsequently fragments the resulting IPv6 tunnel packet into IPv6 fragments that do not exceed the Path MTU to the tunnel exit-point.

Dropping the MTU check for ipsec tunnel destinations.

Signed-off-by Ashwanth Goli <[email protected]>

---
 net/ipv6/ip6_output.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

net/ipv6/ip6_output.c +1 -1

index 2e891d2..c4c3313 100644
@@ -1235,7 +1235,7 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
 		if (np->frag_size)
 			mtu = np->frag_size;
 	}
-	if (mtu < IPV6_MIN_MTU)
+	if (!(rt->dst.flags & DST_XFRM_TUNNEL) && mtu < IPV6_MIN_MTU)
 		return -EINVAL;
 	cork->base.fragsize = mtu;
 	if (dst_allfrag(xfrm_dst_path(&rt->dst)))

Signature · 1 line

1.9.1

Eric Dumazet

2018-05-10 17:05 UTC #1 lore raw

Quoted 26 lines · Ashwanth Goli

With 749439bfac "fix udpv6 sendmsg crash caused by too small MTU" ipsec tunnels that report a MTU less than IPV6_MIN_MTU are broken even for packets that are smaller than IPV6_MIN_MTU.
According to rfc2473#section-7.1
if the original IPv6 packet is equal or smaller than the IPv6 minimum link MTU, the tunnel entry-point node encapsulates the original packet, and subsequently fragments the resulting IPv6 tunnel packet into IPv6 fragments that do not exceed the Path MTU to the tunnel exit-point.
Dropping the MTU check for ipsec tunnel destinations.
Signed-off-by Ashwanth Goli <[email protected]>
---
 net/ipv6/ip6_output.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ip6_output.c +0 -0
index 2e891d2..c4c3313 100644

net/ipv6/ip6_output.c static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork, · line 1241

Quoted 8 lines

net/ipv6/ip6_output.c +1 -1

@@ -1235,7 +1235,7 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
 		if (np->frag_size)
 			mtu = np->frag_size;
 	}
-	if (mtu < IPV6_MIN_MTU)
+	if (!(rt->dst.flags & DST_XFRM_TUNNEL) && mtu < IPV6_MIN_MTU)
 		return -EINVAL;
 	cork->base.fragsize = mtu;
 	if (dst_allfrag(xfrm_dst_path(&rt->dst)))

Given that the (mtu < IPV6_MIN_MTU) condition is unlikely, I would reorder to :

if (mtu < IPV6_MIN_MTU && !(rt->dst.flags & DST_XFRM_TUNNEL))

	return -EINVAL;

The fast path should not look at dst.flags