lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Wed, 20 May 2015 19:06:36 -0700
From:	Alexander Duyck <>
To:	Steffen Klassert <>,
	Alexander Duyck <>
CC:	David Miller <>, NetDev <>
Subject: Re: Looking for a lost patch

On 05/19/2015 11:32 PM, Steffen Klassert wrote:
> On Tue, May 19, 2015 at 11:32:15AM -0700, Alexander Duyck wrote:
>> On 05/19/2015 12:57 AM, Steffen Klassert wrote:
>>> The MTU should be 1500. All the IPsec overhead is handled by PMTU
>>> discovery, just like in the case we use IPsec without vti tunnels.
>>> The IPv6 side of vti does it like that.
>> The problem is the PMTU isn't communicated to things that make use
>> of the tunnel.  For example if I do a "ping -s 2000 x.x.x.x" across
>> an IPv6 VTI interface it will fail currently as it assumes the MTU
>> is 1500 and so it is fragmenting the ping packet at sizes that won't
>> be communicated across the underlying interface.
> Well, the problem is that the local socket is still attached on the
> skb. The socket gets an error notification if the packet is too big,
> but ping does not care much about these error notifications.
> One option to get such applications to work is to orphan the skb
> in the vti xmit function. Then the packet is not assumed to be
> local, so PMTU discovery is triggered on that route.
> Something like this should work for IPv6:
> diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
> index ed9d681..cd50bc1 100644
> --- a/net/ipv6/ip6_vti.c
> +++ b/net/ipv6/ip6_vti.c
> @@ -459,6 +459,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
>   		goto tx_err_dst_release;
>   	}
> +	skb_orphan(skb);
>   	skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
>   	skb_dst_set(skb, dst);
>   	skb->dev = skb_dst(skb)->dev;

This works, sort-of.  I have to ping from both ends before I can start 
to send traffic.

I am going to do some digging.  It seems like there should be some way 
to get the PMTU fed back into the PMTU for the VTI interface. If we can 
do that it would save a ton of pain.

- Alex
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists