lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 3 Aug 2020 17:46:42 -0600
From:   David Ahern <>
To:     Florian Westphal <>,
        Stefano Brivio <>
Cc:     "David S. Miller" <>,
        Aaron Conole <>,
        Numan Siddique <>,
        Jakub Kicinski <>,
        Pravin B Shelar <>,
        Roopa Prabhu <>,
        Nikolay Aleksandrov <>,
        Lourdes Pedrajas <>,
Subject: Re: [PATCH net-next 0/6] Support PMTU discovery with bridged UDP

On 8/3/20 5:28 PM, Florian Westphal wrote:
> Stefano Brivio <> wrote:
>> Currently, PMTU discovery for UDP tunnels only works if packets are
>> routed to the encapsulating interfaces, not bridged.
>> This results from the fact that we generally don't have valid routes
>> to the senders we can use to relay ICMP and ICMPv6 errors, and makes
>> PMTU discovery completely non-functional for VXLAN and GENEVE ports of
>> both regular bridges and Open vSwitch instances.
>> If the sender is local, and packets are forwarded to the port by a
>> regular bridge, all it takes is to generate a corresponding route
>> exception on the encapsulating device. The bridge then finds the route
>> exception carrying the PMTU value estimate as it forwards frames, and
>> relays ICMP messages back to the socket of the local sender. Patch 1/6
>> fixes this case.
>> If the sender resides on another node, we actually need to reply to
>> IP and IPv6 packets ourselves and send these ICMP or ICMPv6 errors
>> back, using the same encapsulating device. Patch 2/6, based on an
>> original idea by Florian Westphal, adds the needed functionality,
>> while patches 3/6 and 4/6 add matching support for VXLAN and GENEVE.
>> Finally, 5/6 and 6/6 introduce selftests for all combinations of
>> inner and outer IP versions, covering both VXLAN and GENEVE, with
>> both regular bridges and Open vSwitch instances.
> Thanks for taking over and brining this into shape, this looks good to
> me.

+1. I'm sure this took quite a bit of your time. Thanks for doing that.
I like this version much better.

Powered by blists - more mailing lists