Skip to contentSkip to conversation

Linux 3.4.92 breaks forwarding with netfilter enabled

DISCUSSION Jiri Slaby 4 participants 4 messages Jun 11, 2014 – Jun 12, 2014 1 message not in the archive

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Jiri Slaby

author
#1 lore raw
In reply to a message not in the archive
Quoted 49 lines · Florian Westphal

[ stable specific regression. I wanted to CC stable@ on my reply below
but I fat-fingered the address... ]

Quoted 12 lines · Egerváry Gergely
Quoted 11 lines

Hi,

we have just upgraded our systems from 3.4.91 (longterm) to 3.4.92. Since then we are experiencing dozens of MTU-related network timeout issues. Reverting back to 3.4.91 fixes all of these problems.

Both kernel versions are built from vanilla sources with the same .config. These can be highly reproduced over VPN tunnels or even over simple ethernet connections when using DNAT. (TCP port forward) It looks like MTU path discovery is somehow affected.

Quoted 4 lines
Quoted 4 lines

ICMP is not filtered in our network. (For testing, we flushed all iptables rules, set all policies to ACCEPT, and problem still exists.) We do not use any special sysctl settings. Was there any changes related to packet forwarding or MTU discovery?

These were in earlier releases than 3.4.92.

Quoted 3 lines

some combination of old kernel and backport of ("net: ipv4:
ip_forward: fix inverted local_df test") ?
just guessing

Excellent guess. Yes, this is the culprit.

Quoting that patch changelog:

'This wasn't noticed earlier [..] because netfilter ip defrag did not set local_df until couple of days ago.'

-stable lacks commit 895162b1101b3ea5db08ca6822ae9672717efec0, so netfilter never sets ->local_df. Thus all defragmented packets that go over the mtu are refused to be forwarded.

Gergely, please either revert

commit bd91cb56f951a7b0da8c3098ea9cd56854ece66c
Author: Florian Westphal <[email protected]>
net: ipv4: ip_forward: fix inverted local_df test [ Upstream commit ca6c5d4ad216d5942ae544bbf02503041bd802aa ]

Or, alternatively, also apply upstream commit 895162b1101b3ea5db08ca6822ae9672717efec0
Author: Florian Westphal <[email protected]>
Date: Fri May 2 15:32:16 2014 +0200
netfilter: ipv4: defrag: set local_df flag on defragmented skb

Quoted 5 lines

on top of your 3.4.92 kernel.

(The latter might be a better option since it will also fix the
long-standing issue where netfilter sends bogus frag-needed message under very rare circumstances).

I believe, the same holds for 3.12, right? (I have just applied "defrag:
set local_df flag on defragmented skb".)

thanks,

Signature · 2 lines
js
suse labs
#2 lore raw
Quoted 12 lines · Jiri Slaby
Quoted 12 lines

Gergely, please either revert

commit bd91cb56f951a7b0da8c3098ea9cd56854ece66c
Author: Florian Westphal <[email protected]>
net: ipv4: ip_forward: fix inverted local_df test [ Upstream commit ca6c5d4ad216d5942ae544bbf02503041bd802aa ]

Or, alternatively, also apply upstream commit 895162b1101b3ea5db08ca6822ae9672717efec0
Author: Florian Westphal <[email protected]>
Date: Fri May 2 15:32:16 2014 +0200
netfilter: ipv4: defrag: set local_df flag on defragmented skb

Quoted 8 lines
Quoted 5 lines

on top of your 3.4.92 kernel.

(The latter might be a better option since it will also fix the
long-standing issue where netfilter sends bogus frag-needed message under very rare circumstances).

I believe, the same holds for 3.12, right? (I have just applied "defrag:
set local_df flag on defragmented skb".)

Yes, its true for all -stable kernels (except new 3.15).

Thanks for taking care of this.

#3 lore raw
Quoted 20 lines · Florian Westphal
Quoted 18 lines · Jiri Slaby
Quoted 17 lines

Gergely, please either revert

commit bd91cb56f951a7b0da8c3098ea9cd56854ece66c
Author: Florian Westphal <[email protected]>
net: ipv4: ip_forward: fix inverted local_df test [ Upstream commit ca6c5d4ad216d5942ae544bbf02503041bd802aa ]

Or, alternatively, also apply upstream commit 895162b1101b3ea5db08ca6822ae9672717efec0
Author: Florian Westphal <[email protected]>
Date: Fri May 2 15:32:16 2014 +0200
netfilter: ipv4: defrag: set local_df flag on defragmented skb

on top of your 3.4.92 kernel.

(The latter might be a better option since it will also fix the
long-standing issue where netfilter sends bogus frag-needed message under very rare circumstances).

Quoted 6 lines
Quoted 2 lines

I believe, the same holds for 3.12, right? (I have just applied "defrag:
set local_df flag on defragmented skb".)

Yes, its true for all -stable kernels (except new 3.15).

Thanks for taking care of this.

Greg, could you apply this one to 3.4,3.10,3.14 as well please?

Or do have concerns about it?

Thanks,

Guillaume.

Signature · 1 line
Guillaume Morin <[email protected]>
#4 lore raw
Quoted 21 lines · Guillaume Morin
Quoted 20 lines · Florian Westphal
Quoted 18 lines · Jiri Slaby
Quoted 17 lines

Gergely, please either revert

commit bd91cb56f951a7b0da8c3098ea9cd56854ece66c
Author: Florian Westphal <[email protected]>
net: ipv4: ip_forward: fix inverted local_df test [ Upstream commit ca6c5d4ad216d5942ae544bbf02503041bd802aa ]

Or, alternatively, also apply upstream commit 895162b1101b3ea5db08ca6822ae9672717efec0
Author: Florian Westphal <[email protected]>
Date: Fri May 2 15:32:16 2014 +0200
netfilter: ipv4: defrag: set local_df flag on defragmented skb

on top of your 3.4.92 kernel.

(The latter might be a better option since it will also fix the
long-standing issue where netfilter sends bogus frag-needed message under very rare circumstances).

Quoted 8 lines
Quoted 6 lines
Quoted 2 lines

I believe, the same holds for 3.12, right? (I have just applied "defrag:
set local_df flag on defragmented skb".)

Yes, its true for all -stable kernels (except new 3.15).

Thanks for taking care of this.

Greg, could you apply this one to 3.4,3.10,3.14 as well please?

I just did that :)

thanks,

greg k-h