netdev - Re: [Bugme-new] [Bug 14837] New: gretap does not fragment IP packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 19 Dec 2009 07:55:03 -0500
From:	jamal <hadi@...erus.ca>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	netdev@...r.kernel.org, bugzilla-daemon@...zilla.kernel.org,
	bugme-daemon@...zilla.kernel.org, benoit.papillault@...e.fr
Subject: Re: [Bugme-new] [Bug 14837] New: gretap does not fragment IP
 packets

On Fri, 2009-12-18 at 15:32 -0800, Andrew Morton wrote:
> (switched to email.  Please respond via emailed reply-to-all, not via the
> bugzilla web interface).
> 
> On Fri, 18 Dec 2009 23:10:01 GMT
> bugzilla-daemon@...zilla.kernel.org wrote:
> 
> > http://bugzilla.kernel.org/show_bug.cgi?id=14837
> > 
> >            Summary: gretap does not fragment IP packets
> >            Product: Networking
> >            Version: 2.5
> >     Kernel Version: 2.6.32
> >           Platform: All
> >         OS/Version: Linux
> >               Tree: Mainline
> >             Status: NEW
> >           Severity: normal
> >           Priority: P1
> >          Component: IPV4
> >         AssignedTo: shemminger@...ux-foundation.org
> >         ReportedBy: benoit.papillault@...e.fr
> >         Regression: No
> > 
> > 
> > When gretap is used to encapsulate Ethernet packets into IP packets, the
> > encapsulated IP packets are larger than the original Ethernet packet, as
> > expected.
> > 
> > Let's say you create a gre0 interface with a 1500 bytes MTU (since this
> > interface will latter be inserted in a bridge interface, its MTU must be 1500).
> > And Let's say the GRE encapsulated packet (now larger than 1500 bytes) is going
> > to be routed over an IP interface with a 1500 bytes MTU.
> > 
> > The expected behavior would be that the encapsulated packet be fragmented. The
> > observed behavior is that any encapsulated packets over 1500 bytes are simply
> > dropped and an ICMP "fragmentation needed" message is sent to ... who knows.

Sending back an ICMP is good behavior. Sending it "who knows" is not ;->
Make sure it is sent to the originator of the packet. The originator of
the packet should play nice and reduce the path mtu.

One work around is to reduce the gre device mtu to something less than
1500B.

cheers,
jamal

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html