netdev - RE: Response error to fragmented ICMP echo request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 8 Mar 2023 06:00:26 +0000
From:   "Song, Xiongwei" <Xiongwei.Song@...driver.com>
To:     Vladimir Oltean <vladimir.oltean@....com>
CC:     "claudiu.manoil@....com" <claudiu.manoil@....com>,
        "alexandre.belloni@...tlin.com" <alexandre.belloni@...tlin.com>,
        "UNGLinuxDriver@...rochip.com" <UNGLinuxDriver@...rochip.com>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "edumazet@...gle.com" <edumazet@...gle.com>,
        "kuba@...nel.org" <kuba@...nel.org>,
        "pabeni@...hat.com" <pabeni@...hat.com>,
        "richardcochran@...il.com" <richardcochran@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: Response error to fragmented ICMP echo request

Hi Vladimir,

> On Tue, Mar 07, 2023 at 12:56:17PM +0000, Song, Xiongwei wrote:
> > > Frames 3 and 4 are sent with DEI=1 and are dropped, frames 1 and 2 are
> > > sent with DEI=0 and are not dropped. I'm not sure if varying the DEI
> > > field is part of the intentions of the test? Is there any RFC which says
> > > that IP fragments over VLAN should use DEI=1, or some other reason?
> >
> > I didn't notice that. Let me check the test why set DEI=1.
> 
> Ok. It would be good to have an answer to this, because one of the
> assumptions of that patch was that whomever sets DEI=1 doesn't get to
> complain that their packets are *actually* dropped :)

We found the problem in the test:
=====================
        f2=Ether(src="26:84:d5:7f:7d:be", dst="7C:72:6E:D4:44:C1")/Dot1Q(prio=0, vlan=984)/IP(src="10.225.32.20", dst="10.225.32.21")/'\x00\x00\x00\x00\x00\x00\x00\x00'
        f2.frag=1
===>f2.id=1
        f2.proto='icmp'
        // result of f2.show()
        ###[ Ethernet ]###
           dst       = 7C:72:6E:D4:44:C1
           src       = 26:84:d5:7f:7d:be
           type      = 0x8100
        ###[ 802.1Q ]###
              prio      = 0
              id        = 1
              vlan      = 984
              type      = 0x800
        ###[ IP ]###
                 version   = 4
                 ihl       = None
                 tos       = 0x0
                 len       = None
                 id        = 1
                 flags     =
                 frag      = 1
                 ttl       = 64
                 proto     = icmp
                 chksum    = None
                 src       = 10.225.32.20
                 dst       = 10.225.32.21
                 \options   \
        ###[ Raw ]###
                    load      = '\x00\x00\x00\x00\x00\x00\x00\x00'
=================
This sets both the L2 & L3 id. L2 id is actually DEI.
We updated the script to only set L3 id and now the test passes.

> 
> FWIW, if you do need to set up a reservation for traffic received on a
> port, section 8.6.3.3.15 Buffer reservation watermarks (page 817) should
> help with this:
> https://www.nxp.com/docs/en/user-guide/LLDPUG_RevL5.15.71-2.2.0.pdf

Thank  you so much. We don't need to set up a reservation for now, but good
to know this.

Regards,
Xiongwei