netdev - Re: [PATCH net v2] ipv4: lock mtu in fnhe when received PMTU < net.ipv4.route.min

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 14 Mar 2018 13:38:13 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     sd@...asysnail.net
Cc:     netdev@...r.kernel.org, sbrivio@...hat.com
Subject: Re: [PATCH net v2] ipv4: lock mtu in fnhe when received PMTU <
 net.ipv4.route.min_pmtu

From: Sabrina Dubroca <sd@...asysnail.net>
Date: Wed, 14 Mar 2018 10:21:14 +0100

> Prior to the rework of PMTU information storage in commit
> 2c8cec5c10bc ("ipv4: Cache learned PMTU information in inetpeer."),
> when a PMTU event advertising a PMTU smaller than
> net.ipv4.route.min_pmtu was received, we would disable setting the DF
> flag on packets by locking the MTU metric, and set the PMTU to
> net.ipv4.route.min_pmtu.
> 
> Since then, we don't disable DF, and set PMTU to
> net.ipv4.route.min_pmtu, so the intermediate router that has this link
> with a small MTU will have to drop the packets.
> 
> This patch reestablishes pre-2.6.39 behavior by splitting
> rtable->rt_pmtu into a bitfield with rt_mtu_locked and rt_pmtu.
> rt_mtu_locked indicates that we shouldn't set the DF bit on that path,
> and is checked in ip_dont_fragment().
> 
> One possible workaround is to set net.ipv4.route.min_pmtu to a value low
> enough to accommodate the lowest MTU encountered.
> 
> Fixes: 2c8cec5c10bc ("ipv4: Cache learned PMTU information in inetpeer.")
> Signed-off-by: Sabrina Dubroca <sd@...asysnail.net>
> Reviewed-by: Stefano Brivio <sbrivio@...hat.com>
> ---
> v2: make rt_pmtu a bitfield
>     fix missing initializations of rt_mtu_locked

Applied and queued up for -stable, thanks.