Re: [PATCH net-next] net: ipv4: Add ability to have GRE ignore DF bit in IPv4 payloads

On 06/07/2016 04:23 PM, Hannes Frederic Sowa wrote:

On 07.06.2016 22:42, Philip Prindeville wrote:

quoted

On 06/07/2016 02:23 PM, Hannes Frederic Sowa wrote:

quoted

On Tue, Jun 7, 2016, at 21:48, Philip Prindeville wrote:

quoted

   static struct rtnl_link_ops ipgre_link_ops __read_mostly = {

diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index d8f5e0a..95649eb 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c

@@ -682,7 +682,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct

net_device *dev,
       }
         df = tnl_params->frag_off;
-       if (skb->protocol == htons(ETH_P_IP))
+       if (skb->protocol == htons(ETH_P_IP) && !tunnel->ignore_df)
           df |= (inner_iph->frag_off&htons(IP_DF));
         max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct
iphdr)

Is still enforce that we inherit the ttl from the inner header to the
outer header if we don't set df bit?

Thanks,
Hannes

That's correct.  That happens a few lines above and we don't change that
behavior with this patch.

It should be discouraged to use this feature, but I have to admit that I
already used stripping of DF bit, too.

Acked-by: Hannes Frederic Sowa <redacted>

Thanks,
Hannes

Yeah, it's admittedly a kludge to get around broken customer firewalls 
which are discarding ICMP's they have no business filtering.

It's the "least ugly workaround" in this scenario.

If you have control over the offending firewalls, it's easier (and 
better) to fix them than configuring this option... but sometimes you 
have to put up with other people having broken equipment on your network.

-Philip