Received: by 2002:a05:6a10:9e8c:0:0:0:0 with SMTP id y12csp241295pxx; Wed, 28 Oct 2020 03:52:17 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyQHp7NBHwl5MVYoqWBJRWrlHfg8bukK6U38m48oKuYZLwDUSrDuOlr4KZ4bfdhNQ8zkqi2 X-Received: by 2002:a17:906:8891:: with SMTP id ak17mr6817674ejc.176.1603882337075; Wed, 28 Oct 2020 03:52:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1603882337; cv=none; d=google.com; s=arc-20160816; b=Dynxb6t2uXpALBUbYMV7n8E8/prJtbSaPXHYiqf4zg06W5vNTS2NBlvboI/oVLSb/g 7sHBfLSYgZrqMfkeEmro90JZK1FVz8M7IfiABfeKTuqiXjRexqEXKYpi/54eptySA6bt asWRaFw2p3tBnzI8CKSe5p06Df3XpyVKVP6fJRCmG7KYGqGgwVoosVv4DcspwDlmTFeU lLgSm1qYVAub9zPjAeCCWCsNZR0gwYxDEIH5GQAQoJhFTmrTJc4sl77Ft+TACCRAmVJK lrdtjkqecs37rDgl0Qq/+wbQTf4Lw5HLrqYDZanm9sDOn0aJSgNsxy0VBugfDaEpskf1 l50A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=2WECFtMfhd0tigG1xStzYcw6wT77kyhjHfNagGXwuCQ=; b=mxGQ2sp3uyKzZhx9pnD+0IU8uxfUg90Hye2jNWOqbbRcOtJ7an6ji7zDQUTgCmFO8x CSdBehVa0sjfPQXAnRuVCrMgAfATot++v65/1See9DtQiH8R6o9852qIRJIImbH8zxG6 lxJmOU6wAoszp5z/mGNpShqhVY7Oo4pbVFXHW9eaVnkd3EtY0LExetvDCCtTIo6S9UjL 9RQ2+7+jY8apJNdduirY6a2okkrik2W0LBNhYppD5eOvy5ErV9RBc6SE9FZ3uzfztF9z qIAC496m9UG3jEmLsIZ7M7fQ/qlkvTxFQISUilX58q6F9AtiDjSCUp79kylwLw9y0Acp HQnQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=R7ivmfYg; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id o10si2705925ejr.482.2020.10.28.03.51.55; Wed, 28 Oct 2020 03:52:17 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=R7ivmfYg; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S368265AbgJ0Oyy (ORCPT + 99 others); Tue, 27 Oct 2020 10:54:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:48550 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1766369AbgJ0Os1 (ORCPT ); Tue, 27 Oct 2020 10:48:27 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 82E20207DE; Tue, 27 Oct 2020 14:48:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603810106; bh=3xlCTxOWEOMQhYcoe1BeKB7U5GuJjiJP74iCimPsXeI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R7ivmfYg7YMjojdf44GQwMohmyYlgRf+l6deguMzcLJalY8JhE2alX5eMqPzxHyAG sxrRkx+M0WJvvwT4aNAjquNS7tudaM/LciElqIxnHpYPipKakN24L1NqWnSRxrMH/1 WGeQQyaPvrcRuxK5IxZ7m0EPyVaEMoacGzEbMMN8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Maciej=20=C5=BBenczykowski?= , Eric Dumazet , Willem de Bruijn , Lorenzo Colitti , "Sunmeet Gill (Sunny)" , Vinay Paradkar , Tyler Wear , David Ahern Subject: [PATCH 5.8 023/633] net/ipv4: always honour route mtu during forwarding Date: Tue, 27 Oct 2020 14:46:06 +0100 Message-Id: <20201027135523.780570569@linuxfoundation.org> X-Mailer: git-send-email 2.29.1 In-Reply-To: <20201027135522.655719020@linuxfoundation.org> References: <20201027135522.655719020@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: "Maciej Żenczykowski" [ Upstream commit 02a1b175b0e92d9e0fa5df3957ade8d733ceb6a0 ] Documentation/networking/ip-sysctl.txt:46 says: ip_forward_use_pmtu - BOOLEAN By default we don't trust protocol path MTUs while forwarding because they could be easily forged and can lead to unwanted fragmentation by the router. You only need to enable this if you have user-space software which tries to discover path mtus by itself and depends on the kernel honoring this information. This is normally not the case. Default: 0 (disabled) Possible values: 0 - disabled 1 - enabled Which makes it pretty clear that setting it to 1 is a potential security/safety/DoS issue, and yet it is entirely reasonable to want forwarded traffic to honour explicitly administrator configured route mtus (instead of defaulting to device mtu). Indeed, I can't think of a single reason why you wouldn't want to. Since you configured a route mtu you probably know better... It is pretty common to have a higher device mtu to allow receiving large (jumbo) frames, while having some routes via that interface (potentially including the default route to the internet) specify a lower mtu. Note that ipv6 forwarding uses device mtu unless the route is locked (in which case it will use the route mtu). This approach is not usable for IPv4 where an 'mtu lock' on a route also has the side effect of disabling TCP path mtu discovery via disabling the IPv4 DF (don't frag) bit on all outgoing frames. I'm not aware of a way to lock a route from an IPv6 RA, so that also potentially seems wrong. Signed-off-by: Maciej Żenczykowski Cc: Eric Dumazet Cc: Willem de Bruijn Cc: Lorenzo Colitti Cc: Sunmeet Gill (Sunny) Cc: Vinay Paradkar Cc: Tyler Wear Cc: David Ahern Reviewed-by: Eric Dumazet Signed-off-by: Greg Kroah-Hartman --- include/net/ip.h | 6 ++++++ 1 file changed, 6 insertions(+) --- a/include/net/ip.h +++ b/include/net/ip.h @@ -439,12 +439,18 @@ static inline unsigned int ip_dst_mtu_ma bool forwarding) { struct net *net = dev_net(dst->dev); + unsigned int mtu; if (net->ipv4.sysctl_ip_fwd_use_pmtu || ip_mtu_locked(dst) || !forwarding) return dst_mtu(dst); + /* 'forwarding = true' case should always honour route mtu */ + mtu = dst_metric_raw(dst, RTAX_MTU); + if (mtu) + return mtu; + return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU); }