netdev - Re: [PATCH net] tunnels: Accept PACKET_HOST in skb_tunnel_check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250329082008.7b27e74e@elisabeth>
Date: Sat, 29 Mar 2025 08:20:08 +0100
From: Stefano Brivio <sbrivio@...hat.com>
To: Guillaume Nault <gnault@...hat.com>
Cc: David Miller <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
 Paolo Abeni <pabeni@...hat.com>, Eric Dumazet <edumazet@...gle.com>,
 netdev@...r.kernel.org, Simon Horman <horms@...nel.org>, David Ahern
 <dsahern@...nel.org>, Pravin B Shelar <pshelar@....org>, Aaron Conole
 <aconole@...hat.com>, Eelco Chaudron <echaudro@...hat.com>,
 dev@...nvswitch.org
Subject: Re: [PATCH net] tunnels: Accept PACKET_HOST in
 skb_tunnel_check_pmtu().

On Sat, 29 Mar 2025 01:33:44 +0100
Guillaume Nault <gnault@...hat.com> wrote:

> Because skb_tunnel_check_pmtu() doesn't handle PACKET_HOST packets,
> commit 30a92c9e3d6b ("openvswitch: Set the skbuff pkt_type for proper
> pmtud support.") forced skb->pkt_type to PACKET_OUTGOING for
> openvswitch packets that are sent using the OVS_ACTION_ATTR_OUTPUT
> action. This allowed such packets to invoke the
> iptunnel_pmtud_check_icmp() or iptunnel_pmtud_check_icmpv6() helpers
> and thus trigger PMTU update on the input device.
> 
> However, this also broke other parts of PMTU discovery. Since these
> packets don't have the PACKET_HOST type anymore, they won't trigger the
> sending of ICMP Fragmentation Needed or Packet Too Big messages to
> remote hosts when oversized (see the skb_in->pkt_type condition in
> __icmp_send() for example).
> 
> These two skb->pkt_type checks are therefore incompatible as one
> requires skb->pkt_type to be PACKET_HOST, while the other requires it
> to be anything but PACKET_HOST.
> 
> It makes sense to not trigger ICMP messages for non-PACKET_HOST packets
> as these messages should be generated only for incoming l2-unicast
> packets. However there doesn't seem to be any reason for
> skb_tunnel_check_pmtu() to ignore PACKET_HOST packets.

No valid reason, right.

That (bogus) check just came from the specific functionality I meant to
implement back then: PMTU discovery for paths where we forward packets
(PACKET_OTHERHOST or PACKET_OUTGOING).

But we should handle packets that are (in some sense) going to us
(PACKET_HOST) in the same way.

> Allow both cases to work by allowing skb_tunnel_check_pmtu() to work on
> PACKET_HOST packets and not overriding skb->pkt_type in openvswitch
> anymore.
> 
> Fixes: 30a92c9e3d6b ("openvswitch: Set the skbuff pkt_type for proper pmtud support.")
> Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets")
> Signed-off-by: Guillaume Nault <gnault@...hat.com>

Reviewed-by: Stefano Brivio <sbrivio@...hat.com>

Thanks for fixing this!

-- 
Stefano