[PATCH ipsec,v2] xfrm: interface: fix ipv4 pmtu check to honor ip header df

Frag needed should only be sent if the header enables DF.

This fix allows packets larger than MTU to pass the xfrm interface
and be fragmented after encapsulation, aligning behavior with
non-interface xfrm.

Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
Signed-off-by: Eyal Birger <redacted>

-----

v2: better align coding with ip_vti
---
 net/xfrm/xfrm_interface.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
index 697cdcfbb5e1..3f42c2f15ba4 100644
--- a/net/xfrm/xfrm_interface.c
+++ b/net/xfrm/xfrm_interface.c

@@ -305,6 +305,8 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 
 			icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 		} else {
+			if (!(ip_hdr(skb)->frag_off & htons(IP_DF)))
+				goto xmit;
 			icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
 				      htonl(mtu));
 		}

@@ -313,6 +315,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 		return -EMSGSIZE;
 	}
 
+xmit:
 	xfrmi_scrub_packet(skb, !net_eq(xi->net, dev_net(dev)));
 	skb_dst_set(skb, dst);
 	skb->dev = tdev;

-- 
2.25.1

2021-02-20, 15:01:15 +0200, Eyal Birger wrote:

Frag needed should only be sent if the header enables DF.

This fix allows packets larger than MTU to pass the xfrm interface
and be fragmented after encapsulation, aligning behavior with
non-interface xfrm.

Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
Signed-off-by: Eyal Birger <redacted>

-----

v2: better align coding with ip_vti

LGTM. We also need to do the same thing in ip_vti and ip6_vti. Do you
want to take care of it, or should I?

Either way, for this patch:
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>

-- 
Sabrina

On 23/02/2021 16:12, Sabrina Dubroca wrote:

LGTM. We also need to do the same thing in ip_vti and ip6_vti. Do you
want to take care of it, or should I?
  

See the thread
https://lore.kernel.org/netdev/1552865877-13401-1-git-send-email-bram-yvahk@mail.wizbit.be/
(I'm assuming the patches no longer applies cleanly but given that I was
ignored last time I will not be resubmitting them.)

--
Bram

Hi,

On Tue, Feb 23, 2021 at 5:18 PM Sabrina Dubroca [off-list ref] wrote:

2021-02-20, 15:01:15 +0200, Eyal Birger wrote:

quoted

Frag needed should only be sent if the header enables DF.

This fix allows packets larger than MTU to pass the xfrm interface
and be fragmented after encapsulation, aligning behavior with
non-interface xfrm.

Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
Signed-off-by: Eyal Birger <redacted>

-----

v2: better align coding with ip_vti

LGTM. We also need to do the same thing in ip_vti and ip6_vti. Do you
want to take care of it, or should I?

I can submit the same fix for vti{,6}.

Either way, for this patch:
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>

Thanks!
Eyal.

On Tue, Feb 23, 2021 at 04:12:34PM +0100, Sabrina Dubroca wrote:

2021-02-20, 15:01:15 +0200, Eyal Birger wrote:

quoted

Frag needed should only be sent if the header enables DF.

This fix allows packets larger than MTU to pass the xfrm interface
and be fragmented after encapsulation, aligning behavior with
non-interface xfrm.

Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
Signed-off-by: Eyal Birger <redacted>

-----

v2: better align coding with ip_vti

LGTM. We also need to do the same thing in ip_vti and ip6_vti. Do you
want to take care of it, or should I?

Either way, for this patch:
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>

Applied, thanks everyone!