netdev - sysctl to clamp mtu on all application-initiated sockets?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sun, 16 Nov 2014 01:28:43 +0100
From:	oskar@...ex.se
To:	<netdev@...r.kernel.org>
Subject: sysctl to clamp mtu on all application-initiated
 sockets?

Hi!

I'm trying to setup routers that should be able to forward 
jumbo-packets, but applications should not get jumbo-capable sockets.

The major brands of routers support something like this. You set mtu 
for forwarding to something big (8192, 9000) but don't touch the system 
mtu of 1500.
Management-traffic, routing protocols and such communicate with 
<=1500byte packets, but the router can forward frames up to <big> mtu 
size if other machines feel like using them.

The only ways I've found to do this is either through mss-clamping in 
iptables (+ some iptables rule that drop other packets and return ICMP 
Packet too big), or update each route on the router with an MTU 
argument, but it feels clunky and i believe this will cause quite some 
overhead which would impact forwarding-performance of the router 
negatively, It's also not nice to change tcp packet values on the fly. 
(The MTU on routes-path is quite a lot of work when running IPv4 DHCP 
client + IPv6 RA-learned routes + full BGP table on multiple boxes, it's 
easy to miss something)

So, is it possible to create something like 
/proc/sys/net/ipv*/max_socket_mtu that would clamp the MTU of all 
created sockets to some nice value?

It should also be possible to override this clamping on a per-socket 
basis (and use up to link-layer MTU size) by setting a flag or such on 
the socket, for example tunnels.

I need to solve this some how for forwarding + VXLAN, but I believe 
this would also apply to and simplify management of other tunnel 
techniques. The tunnel interface should be able to transmit encapsulated 
packets using up to link-layer MTU size inside my datacenter/network, 
but applications on the same machine shouldn't when sending data 
somewhere since it would cause extra roundtrips / broken sessions when 
oversize packets are being dropped somewhere else in the network / on 
the Internet.

Best regards
Oskar Stenman
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html