Subject: Re: [PATCH net 3/3] net: ip: always refragment ip defragmented packets

From: Christian Perle <[email-masked]>
Date: Thu, 7 Jan 2021 08:52:50 +0100

Hello Florian,

On Wed, Jan 06, 2021 at 00:15:23 +0100, Florian Westphal wrote:

> Force refragmentation as per original sizes unconditionally so ip tunnel
> will encapsulate the fragments instead.
[...]
> diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
> index 89fff5f59eea..2ed0b01f72f0 100644
> --- a/net/ipv4/ip_output.c
> +++ b/net/ipv4/ip_output.c
> @@ -302,7 +302,7 @@ static int __ip_finish_output(struct net *net, struct sock *sk, struct sk_buff *
>  	if (skb_is_gso(skb))
>  		return ip_finish_output_gso(net, sk, skb, mtu);
>  
> -	if (skb->len > mtu || (IPCB(skb)->flags & IPSKB_FRAG_PMTU))
> +	if (skb->len > mtu || IPCB(skb)->frag_max_size)
>  		return ip_fragment(net, sk, skb, mtu, ip_finish_output2);
>  
>  	return ip_finish_output2(net, sk, skb);
> -- 
> 2.26.2

Did some tests yesterday and I can confirm that this patch fixes the
problem for both IPIP tunnel and XFRM tunnel interfaces.

Thanks for the fix!
  Christian Perle
-- 
Christian Perle
Senior Berater / Senior Consultant
Netzwerk- und Client-Sicherheit / Network & Client Security
Öffentliche Auftraggeber / Public Authorities
secunet Security Networks AG

Tel.: +49 201 54 54-3533, Fax: +49 201 54 54-1323
E-Mail: [email-masked]
Ammonstraße 74, 01067 Dresden, Deutschland
www.secunet.com

secunet Security Networks AG
Sitz: Kurfürstenstraße 58, 45138 Essen, Deutschland
Amtsgericht Essen HRB 13615
Vorstand: Axel Deininger (Vors.), Torsten Henn, Dr. Kai Martius, Thomas Pleines
Aufsichtsratsvorsitzender: Ralf Wintergerst