ip_tunnel: Respect the IP_DF bit of the inner packet.

The pmtu calculation depends on the IP_DF bit in tnl_update_pmtu(). If the IP_DF bit is set, the pmtu calculation is based on the outer packet size. Otherwise it is based on the inner packet size. If xfrm is used after tunneling through an ipip device, the mtu of the outer device can be lower than the mtu of the ipip device. Reporting the mtu of the ipip device is wrong in this case. So respect the IP_DF bit of the inner packet on ipv4 to report the calculated mtu of the outer device.

---

I marked this as RFC because it affects the mtu calculation of gre tunnels too. I think it should be ok, but I have no testcase to confirm the correctness for gre tunnels. So would be good if someone with gre knowlegde could look at this.

If it turns out that we can't do that for gre, we need to split this code back into a gre and an ipip version.

 net/ipv4/ip_tunnel.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

index 0bb8e14..f6f2d10 100644
@@ -738,7 +738,11 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
 		goto tx_error;
 	}
 
-	if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off)) {
+	df = tnl_params->frag_off;
+	if (skb->protocol == htons(ETH_P_IP))
+		df |= (inner_iph->frag_off&htons(IP_DF));
+
+	if (tnl_update_pmtu(dev, skb, rt, df)) {
 		ip_rt_put(rt);
 		goto tx_error;
 	}

@@ -767,10 +771,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
 			ttl = ip4_dst_hoplimit(&rt->dst);
 	}
 
-	df = tnl_params->frag_off;
-	if (skb->protocol == htons(ETH_P_IP))
-		df |= (inner_iph->frag_off&htons(IP_DF));
-
 	max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr)
 			+ rt->dst.header_len + ip_encap_hlen(&tunnel->encap);
 	if (max_headroom > dev->needed_headroom)

1.9.1

From: Steffen Klassert <[email protected]>
Date: Wed, 5 Nov 2014 09:09:30 +0100

Looking quickly at this, the don't-frag handling in the pre-ip-tunneling GRE code conversion used different conditions wrt. calculating 'df'.

It takes the frag off from skb->data's IPH when skb->protocol is GRE, for example.

So we may have to do this split.