netdev - Re: problem forwarding IP fragments with DF bit set (caused by ipv4: fix path MTU discovery with connection tracking)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1398782535.4033.11.camel@sakura.staff.proxad.net>
Date:	Tue, 29 Apr 2014 16:42:15 +0200
From:	Maxime Bizon <mbizon@...ebox.fr>
To:	Patrick McHardy <kaber@...sh.net>
Cc:	Eric Dumazet <edumazet@...gle.com>, davem@...emloft.net,
	netdev <netdev@...r.kernel.org>
Subject: Re: problem forwarding IP fragments with DF bit set (caused by
 ipv4: fix path MTU discovery with connection tracking)

On Tue, 2014-04-29 at 15:33 +0100, Patrick McHardy wrote:

> That is the correct behaviour.

is it ?

say the remote host is sending two 1000 bytes fragments, with DF set to
me and my MTU is 1500, I'm suppose to route these packets to an
interface with the same MTU.

without conntrack both fragments are correctly forwarded

with conntrack, the original packet is re-assembled, then instead of
forwarding it, we send a "frag needed mtu = 1500" to the remote host,
which never sent any packets bigger than 1500 at the beginning.

-- 
Maxime

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html