netdev - Re: [PATCH net] tunnels: Accept PACKET_HOST in skb_tunnel_check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f7tr02dnz42.fsf@redhat.com>
Date: Mon, 31 Mar 2025 08:50:05 -0400
From: Aaron Conole <aconole@...hat.com>
To: Guillaume Nault <gnault@...hat.com>
Cc: David Miller <davem@...emloft.net>,  Jakub Kicinski <kuba@...nel.org>,
  Paolo Abeni <pabeni@...hat.com>,  Eric Dumazet <edumazet@...gle.com>,
  netdev@...r.kernel.org,  Simon Horman <horms@...nel.org>,  David Ahern
 <dsahern@...nel.org>,  Pravin B Shelar <pshelar@....org>,  Eelco Chaudron
 <echaudro@...hat.com>,  Stefano Brivio <sbrivio@...hat.com>,
  dev@...nvswitch.org
Subject: Re: [PATCH net] tunnels: Accept PACKET_HOST in
 skb_tunnel_check_pmtu().

Guillaume Nault <gnault@...hat.com> writes:

> Because skb_tunnel_check_pmtu() doesn't handle PACKET_HOST packets,
> commit 30a92c9e3d6b ("openvswitch: Set the skbuff pkt_type for proper
> pmtud support.") forced skb->pkt_type to PACKET_OUTGOING for
> openvswitch packets that are sent using the OVS_ACTION_ATTR_OUTPUT
> action. This allowed such packets to invoke the
> iptunnel_pmtud_check_icmp() or iptunnel_pmtud_check_icmpv6() helpers
> and thus trigger PMTU update on the input device.
>
> However, this also broke other parts of PMTU discovery. Since these
> packets don't have the PACKET_HOST type anymore, they won't trigger the
> sending of ICMP Fragmentation Needed or Packet Too Big messages to
> remote hosts when oversized (see the skb_in->pkt_type condition in
> __icmp_send() for example).
>
> These two skb->pkt_type checks are therefore incompatible as one
> requires skb->pkt_type to be PACKET_HOST, while the other requires it
> to be anything but PACKET_HOST.
>
> It makes sense to not trigger ICMP messages for non-PACKET_HOST packets
> as these messages should be generated only for incoming l2-unicast
> packets. However there doesn't seem to be any reason for
> skb_tunnel_check_pmtu() to ignore PACKET_HOST packets.
>
> Allow both cases to work by allowing skb_tunnel_check_pmtu() to work on
> PACKET_HOST packets and not overriding skb->pkt_type in openvswitch
> anymore.
>
> Fixes: 30a92c9e3d6b ("openvswitch: Set the skbuff pkt_type for proper pmtud support.")
> Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets")
> Signed-off-by: Guillaume Nault <gnault@...hat.com>
> ---

Thanks, Guillaume.

Reviewed-by: Aaron Conole <aconole@...hat.com>

I did manage to test this with two hosts over the weekend, and it
appears to work for at least one forwarding case that I encountered.

Tested-by: Aaron Conole <aconole@...hat.com>