Re: [PATCH RFC] xfrm{4,6}: only report errors back to local sockets if we don't cross address family
From: Eric Dumazet <hidden>
Date: 2013-08-08 22:58:01
On Fri, 2013-08-09 at 00:44 +0200, Hannes Frederic Sowa wrote:
On Thu, Aug 01, 2013 at 12:05:22PM +0200, Steffen Klassert wrote:quoted
On Thu, Aug 01, 2013 at 10:11:50AM +0200, Hannes Frederic Sowa wrote:quoted
If you have not yet done so, I would try to find a solution over the weekend.I have not yet done so, please go ahead.Ok, this patch should do the trick. In xfrm6 error path we now generate a plain icmpv6 packet back to us in this specific case vi0oss reported. I wonder if we should suppress these. Btw. is the memset(IPCB, 0) actually needed in the ipv4 output path? [PATCH RFC] net: orphan socket when skb traverses tunnel interface When a local generated packet traverses a tunnel the socket has to be orphaned from the skb. Otherwise lower layer, like xfrm, try to report errors directly to this socket. If, because of a transitioning tunnel, the address family changes we deliver an invalid error or panic in the error reporting functions. Also add a call to secpath_reset() in the ipv6 tunnel xmit path. It seems like it was just forgotten. Reported-by: <redacted> Cc: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Hannes Frederic Sowa <redacted> ---
Doing so breaks flow control. A single socket can flood and fill the Qdisc, even a friendly one like a local TCP flow (see TCP Small Queues) Can't we make the error reporting more robust instead ?