Re: iptables CLAMP MSS to PMTU not working?

On Mon, Jul 16, 2012 at 10:55:46AM +0300, Timo Teras wrote:

On Mon, 16 Jul 2012 09:23:05 +0200 Steffen Klassert
[off-list ref] wrote:

quoted

I did this patch to avoid to propagate learned PMTU informations.
It restores the behaviour we had before we moved the PMTU informations
to the inetpeer. Unfortunately CLAMPMSS really wants to have the PMTU
informations of an input route, which is not possible any more after
this patch.

Anyway, this patch seems to be obsolete in the net-next tree, as
the cached pmtu informations are back in the route. So we should
remove the check for an output route from ipv4_mtu() in the net-next
tree. This should bring CLAMPMSS back to work, at least for upcoming
kernel versions.

Right, saw those commits. But before net-next hits release, I'd really
need a fix for 3.3/3.4/3.5. Non-working fragmentation with IPsec, and
this CLAMPMSS thingy are an upgrade stopper for me.

Would it be safe to just revert this commit, with the side-effect of
exposing cached pmtu too agressively?

The router that can't send the packet to the next hop network has to
send the ICMP Destination Unreachable message. We never propagated
learned PMTU informations and I would not like to change this, in
particular not in a stable kernel.

Maybe we could fix this for already released kernels within the
netfilter module. Perhaps we could add a function

static unsigned int tcpmss_mtu(const struct dst_entry *dst)
{
        unsigned int mtu = dst_metric_raw(dst, RTAX_MTU); 

        return mtu ? : dst_mtu(dst->path);
}


and use this instead of dst_mtu().

Or would it be better to try to backport the relevant changes of moving
pmtu back to route table?

A backport is probaply too invasive for a stable kernel.