linux-kernel - xfrm: is pmtu broken with ESP tunneling?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <52F890D2.2060109@odi.ch>
Date:	Mon, 10 Feb 2014 09:41:54 +0100
From:	Ortwin Glück <odi@....ch>
To:	linux-kernel@...r.kernel.org, netdev@...r.kernel.org
Subject: xfrm: is pmtu broken with ESP tunneling?

Hi,

I am using Openswan to configure an IPSec VPN (using the xfrm/netkey 
backend). Large HTTP POST requests from the client seem to get stuck, 
because the outgoing packets are 1530 bytes (before being wrapped into 
ESP packets). The problem goes away by setting sysctl 
net.ipv4.ip_no_pmtu_disc=1.

May have something to do with it:
The tunneled network is 10.6.6.6/32 and I am SNAT'ing some destinations 
to that IP, so they get routed through the tunnel. Any other networks 
are not to go through the tunnel.

iptables -t nat -A POSTROUTING -d "${R}" -j SNAT --to-source 10.6.6.6

It seems quite clear to me that xfrm is doing something wrong here.

Ortwin
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/