We've experienced an issue with VTI when the path-mtu is smaller than the size
of the "client" packet.
What happens: IPv4 packet from the client (i.e. another system in the LAN)
attempts to transmit some data; IPv4 header shows that 'DF' bit is not set but
still the client receives ICMPv4 "need-to-frag" message [which the client does
not expect and ignores].
Example: $ ping -s 1300 -M dont -c5 192.168.235.2
PING 192.168.235.3 (192.168.235.3) 1300(1328) bytes of data.
From 192.168.236.254 icmp_seq=1 Frag needed and DF set (mtu = 1214)
From 192.168.236.254 icmp_seq=2 Frag needed and DF set (mtu = 1214)
From 192.168.236.254 icmp_seq=3 Frag needed and DF set (mtu = 1214)
From 192.168.236.254 icmp_seq=4 Frag needed and DF set (mtu = 1214)
From 192.168.236.254 icmp_seq=5 Frag needed and DF set (mtu = 1214)
--- 192.168.235.3 ping statistics ---
5 packets transmitted, 0 received, +5 errors, 100% packet loss, time 3999ms
This is addressed in the first patch of this series. (I don't fully like some
parts of this patch but I'll submit my remarks as a reply to the patch)
When testing the changes with an IPv6 tunnel (and with vti6) another issue/edge
case popped up. Assume: client sends a IP packet with a size of 1500 bytes.
After encrypting this packet [and wrapping it in ESP] it obviously is too large
to transmit as a single IPv6 packet and therefor two fragmented IPv6 packets
are transmitted. However: when the packet size is larger then the (not yet
known) path-mtu then a 'ICMPV6_PKT_TOOBIG' is received.
The problem: the ip6_vti error handler ('vti6_err') does not expect that the
original packet was a fragmented IPv6 packet --> it does not process the
'PKT_TOOBIG' and continues in sending packets that are too big.
This is addressed in the second patch.
Bram Yvahk (2):
vti: fragment IPv4 packets when DF bit is not set
vti6: process icmp msg when IPv6 is fragmented
net/ipv4/ip_vti.c | 43 +++++++++++++++++++---------
net/ipv6/ip6_vti.c | 83 +++++++++++++++++++++++++++++++++++++++++-------------
2 files changed, 92 insertions(+), 34 deletions(-)
--
2.7.0
