From patchwork Mon Apr 6 13:58:50 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steffen Klassert X-Patchwork-Id: 25637 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id D0ECADE17A for ; Tue, 7 Apr 2009 00:20:44 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755587AbZDFOUi (ORCPT ); Mon, 6 Apr 2009 10:20:38 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1755472AbZDFOUi (ORCPT ); Mon, 6 Apr 2009 10:20:38 -0400 Received: from a.mx.secunet.com ([213.68.205.161]:42184 "EHLO a.mx.secunet.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755415AbZDFOUi (ORCPT ); Mon, 6 Apr 2009 10:20:38 -0400 X-Greylist: delayed 1420 seconds by postgrey-1.27 at vger.kernel.org; Mon, 06 Apr 2009 10:20:37 EDT Received: from localhost (alg3 [127.0.0.1]) by a.mx.secunet.com (Postfix) with ESMTP id BD44B20C09C; Mon, 6 Apr 2009 15:56:53 +0200 (CEST) X-Virus-Scanned: by secunet Received: from mail-srv1.secumail.de (unknown [10.53.40.200]) by a.mx.secunet.com (Postfix) with ESMTP id 589BE20C07C; Mon, 6 Apr 2009 15:56:53 +0200 (CEST) Received: from gauss.secunet.com ([10.182.7.102]) by mail-srv1.secumail.de over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Mon, 6 Apr 2009 15:56:53 +0200 Received: from klassert by gauss.secunet.com with local (Exim 4.67) (envelope-from ) id 1LqpLe-0005oy-Tv; Mon, 06 Apr 2009 15:58:50 +0200 Date: Mon, 6 Apr 2009 15:58:50 +0200 From: Steffen Klassert To: David Miller , Herbert Xu Cc: netdev@vger.kernel.org Subject: [PATCH] xfrm: fix fragmentation on inter family tunnels Message-ID: <20090406135850.GK6791@secunet.com> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.15+20070412 (2007-04-11) X-OriginalArrivalTime: 06 Apr 2009 13:56:53.0423 (UTC) FILETIME=[8A6DCBF0:01C9B6BF] Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org If an ipv4 packet (not locally generated with IP_DF flag not set) bigger than mtu size is supposed to go via a xfrm ipv6 tunnel, the packetsize check in xfrm4_tunnel_check_size() is omited and ipv6 drops the packet without sending a notice to the original sender of the ipv4 packet. Another issue is that ipv4 connection tracking does reassembling of incomming fragmented packets. If such a reassembled packet is supposed to go via a xfrm ipv6 tunnel it will be droped, even if the original sender did proper fragmentation. According to RFC 2473 (section 7) tunnel ipv6 packets resulting from the encapsulation of an original packet are considered as locally generated packets. If such a packet passed the checks in xfrm{4,6}_tunnel_check_size() fragmentation is allowed according to RFC 2473 (section 7.1/7.2). This patch sets skb->local_df in xfrm6_prepare_output() to achieve fragmentation in this case. Signed-off-by: Steffen Klassert --- net/ipv6/xfrm6_output.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c index 0af823c..5ee5a03 100644 --- a/net/ipv6/xfrm6_output.c +++ b/net/ipv6/xfrm6_output.c @@ -72,6 +72,7 @@ int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb) #endif skb->protocol = htons(ETH_P_IPV6); + skb->local_df = 1; return x->outer_mode->output2(x, skb); }