[IPV6]: Fix IPsec datagram fragmentation (28a89453) · Commits · 戴 / test

This is a long-standing bug in the IPsec IPv6 code that breaks when we emit a IPsec tunnel-mode datagram packet. The problem is that the code the emits the packet assumes the IPv6 stack will fragment it later, but the IPv6 stack assumes that whoever is emitting the packet is going to pre-fragment the packet. In the long term we need to fix both sides, e.g., to get the datagram code to pre-fragment as well as to get the IPv6 stack to fragment locally generated tunnel-mode packet. For now this patch does the second part which should make it work for the IPsec host case. Signed-off-by:

Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv6/ip6_output.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -621,7 +621,7 @@ static int ip6_fragment(struct sk_buff skb, int (output)(struct sk_buff *))
		* or if the skb it not generated by a local socket. (This last
		* check should be redundant, but it's free.)
		*/
		if (!np \|\| np->pmtudisc >= IPV6_PMTUDISC_DO) {
		if (skb->local_df) {
		skb->dev = skb->dst->dev;
		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
		IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
		@@ -1420,6 +1420,10 @@ int ip6_push_pending_frames(struct sock *sk)
		tmp_skb->sk = NULL;
		}

		/* Allow local fragmentation. */
		if (np->pmtudisc >= IPV6_PMTUDISC_DO)
		skb->local_df = 1;

		ipv6_addr_copy(final_dst, &fl->fl6_dst);
		__skb_pull(skb, skb_network_header_len(skb));
		if (opt && opt->opt_flen)

net/ipv6/xfrm6_output.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -36,7 +36,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
		if (mtu < IPV6_MIN_MTU)
		mtu = IPV6_MIN_MTU;

		if (skb->len > mtu) {
		if (!skb->local_df && skb->len > mtu) {
		skb->dev = dst->dev;
		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
		ret = -EMSGSIZE;

Admin message