Commit 353e5c9a authored by Steffen Klassert's avatar Steffen Klassert Committed by David S. Miller
Browse files

ipv4: Fix IPsec slowpath fragmentation problem 



ip_append_data() builds packets based on the mtu from dst_mtu(rt->dst.path).
On IPsec the effective mtu is lower because we need to add the protocol
headers and trailers later when we do the IPsec transformations. So after
the IPsec transformations the packet might be too big, which leads to a
slowpath fragmentation then. This patch fixes this by building the packets
based on the lower IPsec mtu from dst_mtu(&rt->dst) and adapts the exthdr
handling to this.

Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 33f99dc7

net/ipv4/ip_output.c

+5 −5
Original line number Original line Diff line number Diff line
@@ -802,8 +802,6 @@ static int __ip_append_data(struct sock *sk, 
	skb = skb_peek_tail(queue);

	skb = skb_peek_tail(queue);





	exthdrlen = !skb ? rt->dst.header_len : 0;

	exthdrlen = !skb ? rt->dst.header_len : 0;

	length += exthdrlen;

	transhdrlen += exthdrlen;

	mtu = cork->fragsize;

	mtu = cork->fragsize;





	hh_len = LL_RESERVED_SPACE(rt->dst.dev);

	hh_len = LL_RESERVED_SPACE(rt->dst.dev);
@@ -883,6 +881,8 @@ alloc_new_skb: 
			else

			else

				alloclen = fraglen;

				alloclen = fraglen;





			alloclen += exthdrlen;



			/* The last fragment gets additional space at tail.

			/* The last fragment gets additional space at tail.

			 * Note, with MSG_MORE we overallocate on fragments,

			 * Note, with MSG_MORE we overallocate on fragments,

			 * because we have no idea what fragment will be

			 * because we have no idea what fragment will be
@@ -923,11 +923,11 @@ alloc_new_skb: 
			/*

			/*

			 *	Find where to start putting bytes.

			 *	Find where to start putting bytes.

			 */

			 */

			data = skb_put(skb, fraglen);

			data = skb_put(skb, fraglen + exthdrlen);

			skb_set_network_header(skb, exthdrlen);

			skb_set_network_header(skb, exthdrlen);

			skb->transport_header = (skb->network_header +

			skb->transport_header = (skb->network_header +

						 fragheaderlen);

						 fragheaderlen);

			data += fragheaderlen;

			data += fragheaderlen + exthdrlen;





			if (fraggap) {

			if (fraggap) {

				skb->csum = skb_copy_and_csum_bits(

				skb->csum = skb_copy_and_csum_bits(
@@ -1061,7 +1061,7 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork, 
	 */

	 */

	*rtp = NULL;

	*rtp = NULL;

	cork->fragsize = inet->pmtudisc == IP_PMTUDISC_PROBE ?

	cork->fragsize = inet->pmtudisc == IP_PMTUDISC_PROBE ?

			 rt->dst.dev->mtu : dst_mtu(rt->dst.path);

			 rt->dst.dev->mtu : dst_mtu(&rt->dst);

	cork->dst = &rt->dst;

	cork->dst = &rt->dst;

	cork->length = 0;

	cork->length = 0;

	cork->tx_flags = ipc->tx_flags;

	cork->tx_flags = ipc->tx_flags;

CRA Git | Maintained and supported by SUSTech CRA and CCSE