netdev - Re: big ICMP requests get disrupted on IPSec tunnel activation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 16 Oct 2019 08:31:46 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     "Bartschies, Thomas" <Thomas.Bartschies@....de>,
        'David Ahern' <dsahern@...il.com>,
        "'netdev@...r.kernel.org'" <netdev@...r.kernel.org>
Subject: Re: big ICMP requests get disrupted on IPSec tunnel activation



On 10/16/19 5:57 AM, Bartschies, Thomas wrote:
> Hello,
> 
> did another test. This time I've changed the order. First triggered the IPSec policy and then tried to ping in parallel with a big packet size.
> Could also reproduce the issue, but the trace was completely different. May be this time I've got the trace for the problematic connection?
> 

This one was probably a false positive.

The other one, I finally understood what was going on.

You told us you removed netfilter, but it seems you still have the ip defrag modules there.

(For a pure fowarding node, no reassembly-defrag should be needed)

When ip_forward() is used, it correctly clears skb->tstamp

But later, ip_do_fragment() might re-use the skbs found attached to the master skb
and we do not init properly their skb->tstamp 

The master skb->tstamp should be copied to the children.

I will send a patch asap.

Thanks.