Skip to contentSkip to conversation

xfrm: fix fragmentation for ipv4 xfrm tunnel

PATCH Applied Steffen Klassert 3 participants 3 messages Jun 16, 2008 – Jun 17, 2008

Subsystems (3)
Networking Network drivers Networking IPsec
lore
Share & tools
lore

Steffen Klassert

author maintainer
#0 lore raw

PATCH 1/1 xfrm: fix fragmentation for ipv4 xfrm tunnel

When generating the ip header for the transformed packet
we just copy the frag_off field of the ip header from the original packet to the ip header of the new generated packet. If we receive a packet as a chain of fragments, all but the last of the new generated packets have the IP_MF flag set. We have to mask the frag_off field to only keep the IP_DF flag from the original packet. This got lost with git commit

36cf9acf93e8561d9faec24849e57688a81eb9c5 [IPSEC]: Separate inner/outer mode processing on output

Signed-off-by Steffen Klassert <[email protected]>
---
 net/ipv4/xfrm4_mode_tunnel.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
net/ipv4/xfrm4_mode_tunnel.c +1 -1
index 584e6d7..7135279 100644
@@ -52,7 +52,7 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 		IP_ECN_clear(top_iph);
 
 	top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
-			    0 : XFRM_MODE_SKB_CB(skb)->frag_off;
+		0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
 	ip_select_ident(top_iph, dst->child, NULL);
 
 	top_iph->ttl = dst_metric(dst->child, RTAX_HOPLIMIT);
Signature · 1 line
1.5.3
maintainer Acked-by on v1 1/1
#1 lore raw
Quoted 11 lines · Steffen Klassert

When generating the ip header for the transformed packet
we just copy the frag_off field of the ip header from the original packet to the ip header of the new generated packet. If we receive a packet as a chain of fragments, all but the last of the new generated packets have the IP_MF flag set. We have to mask the frag_off field to only keep the IP_DF flag from the original packet. This got lost with git commit

36cf9acf93e8561d9faec24849e57688a81eb9c5 [IPSEC]: Separate inner/outer mode processing on output

Signed-off-by Steffen Klassert <[email protected]>

Good catch!

Acked-by Herbert Xu <[email protected]>

Thanks,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
maintainer Applied
#2 lore raw

From: Herbert Xu <[email protected]>
Date: Tue, 17 Jun 2008 14:44:03 +1000

Quoted 8 lines · Steffen Klassert
Quoted 7 lines

When generating the ip header for the transformed packet
we just copy the frag_off field of the ip header from the original packet to the ip header of the new generated packet. If we receive a packet as a chain of fragments, all but the last of the new generated packets have the IP_MF flag set. We have to mask the frag_off field to only keep the IP_DF flag from the original packet. This got lost with git commit

Quoted 8 lines
Quoted 4 lines

36cf9acf93e8561d9faec24849e57688a81eb9c5 [IPSEC]: Separate inner/outer mode processing on output

Signed-off-by Steffen Klassert <[email protected]>

Good catch!

Acked-by Herbert Xu <[email protected]>

Applied, t hanks everyone.