Patchwork xfrm: fix fragmentation on inter family tunnels

login
register
mail settings
Submitter Steffen Klassert
Date April 6, 2009, 1:58 p.m.
Message ID <20090406135850.GK6791@secunet.com>
Download mbox | patch
Permalink /patch/25637/
State Accepted
Delegated to: David Miller
Headers show

Comments

Steffen Klassert - April 6, 2009, 1:58 p.m.
If an ipv4 packet (not locally generated with IP_DF flag not set) bigger
than mtu size is supposed to go via a xfrm ipv6 tunnel, the packetsize
check in xfrm4_tunnel_check_size() is omited and ipv6 drops the packet
without sending a notice to the original sender of the ipv4 packet.

Another issue is that ipv4 connection tracking does reassembling of
incomming fragmented packets. If such a reassembled packet is supposed to
go via a xfrm ipv6 tunnel it will be droped, even if the original sender
did proper fragmentation.

According to RFC 2473 (section 7) tunnel ipv6 packets resulting from the
encapsulation of an original packet are considered as locally generated
packets. If such a packet passed the checks in xfrm{4,6}_tunnel_check_size()
fragmentation is allowed according to RFC 2473 (section 7.1/7.2).

This patch sets skb->local_df in xfrm6_prepare_output() to achieve
fragmentation in this case.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
 net/ipv6/xfrm6_output.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
David Miller - April 7, 2009, 12:43 a.m.
From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Mon, 6 Apr 2009 15:58:50 +0200

> If an ipv4 packet (not locally generated with IP_DF flag not set) bigger
> than mtu size is supposed to go via a xfrm ipv6 tunnel, the packetsize
> check in xfrm4_tunnel_check_size() is omited and ipv6 drops the packet
> without sending a notice to the original sender of the ipv4 packet.
> 
> Another issue is that ipv4 connection tracking does reassembling of
> incomming fragmented packets. If such a reassembled packet is supposed to
> go via a xfrm ipv6 tunnel it will be droped, even if the original sender
> did proper fragmentation.
> 
> According to RFC 2473 (section 7) tunnel ipv6 packets resulting from the
> encapsulation of an original packet are considered as locally generated
> packets. If such a packet passed the checks in xfrm{4,6}_tunnel_check_size()
> fragmentation is allowed according to RFC 2473 (section 7.1/7.2).
> 
> This patch sets skb->local_df in xfrm6_prepare_output() to achieve
> fragmentation in this case.
> 
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

Applied, thanks Steffen.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 0af823c..5ee5a03 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -72,6 +72,7 @@  int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
 #endif
 
 	skb->protocol = htons(ETH_P_IPV6);
+	skb->local_df = 1;
 
 	return x->outer_mode->output2(x, skb);
 }