Re: [PATCH] xfrm: don't segment UFO packets

2016-03-20 Thread Jiri Bohac
On Thu, Mar 17, 2016 at 01:03:59PM +0800, Herbert Xu wrote: > On Wed, Mar 16, 2016 at 05:00:26PM +0100, Jiri Bohac wrote: > > Prevent xfrm_output() from segmenting UFO packets so that they will be > > fragmented after the xfrm transforms. > > Fair enough. But I wonder if this is enough. Wouldn't

[PATCH] xfrm: don't segment UFO packets

2016-03-19 Thread Jiri Bohac
xfrm_output() will segment GSO packets, including UDP (UFO) packets. this is wrong per RFC4303, section 3.3.4. Fragmentation: If necessary, fragmentation is performed after ESP processing within an IPsec implementation. Thus, transport mode ESP is applied only to whole IP datagrams (

Re: [PATCH] xfrm: don't segment UFO packets

2016-03-19 Thread Jiri Bohac
On Thu, Mar 17, 2016 at 11:24:59AM +0100, Steffen Klassert wrote: > In IPv6 this check is missing, so this could be the > problem if this is IPv6. indeed, this patch also fixes my problem: --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1353,6 +1353,7 @@ emsgsize: (skb &&

Re: [PATCH] xfrm: don't segment UFO packets

2016-03-19 Thread Steffen Klassert
On Thu, Mar 17, 2016 at 11:49:53AM +0100, Jiri Bohac wrote: > On Thu, Mar 17, 2016 at 11:24:59AM +0100, Steffen Klassert wrote: > > > > On Wed, Mar 16, 2016 at 05:00:26PM +0100, Jiri Bohac wrote: > > > Fixes my broken case. > > > > Is this IPv4 or IPv6? IPv4 should not create a GSO skb > > if IPs

Re: [PATCH] xfrm: don't segment UFO packets

2016-03-19 Thread Jiri Bohac
On Thu, Mar 17, 2016 at 11:24:59AM +0100, Steffen Klassert wrote: > > > On Wed, Mar 16, 2016 at 05:00:26PM +0100, Jiri Bohac wrote: > > Fixes my broken case. > > Is this IPv4 or IPv6? IPv4 should not create a GSO skb > if IPsec is done. It checks for rt->dst.header_len > in __ip_append_data() and

Re: [PATCH] xfrm: don't segment UFO packets

2016-03-19 Thread Herbert Xu
On Thu, Mar 17, 2016 at 06:08:55PM +0100, Jiri Bohac wrote: > On Thu, Mar 17, 2016 at 11:24:59AM +0100, Steffen Klassert wrote: > > In IPv6 this check is missing, so this could be the > > problem if this is IPv6. > > indeed, this patch also fixes my problem: Hmm, is this what you really want? If

Re: [PATCH] xfrm: don't segment UFO packets

2016-03-19 Thread Steffen Klassert
On Thu, Mar 17, 2016 at 10:41:15AM +0100, Jiri Bohac wrote: > On Thu, Mar 17, 2016 at 01:03:59PM +0800, Herbert Xu wrote: > > On Wed, Mar 16, 2016 at 05:00:26PM +0100, Jiri Bohac wrote: > > > Prevent xfrm_output() from segmenting UFO packets so that they will be > > > fragmented after the xfrm tran

Re: [PATCH] xfrm: don't segment UFO packets

2016-03-19 Thread Herbert Xu
On Wed, Mar 16, 2016 at 05:00:26PM +0100, Jiri Bohac wrote: > xfrm_output() will segment GSO packets, including UDP (UFO) packets. > this is wrong per RFC4303, section 3.3.4. Fragmentation: > >If necessary, fragmentation is performed after ESP >processing within an IPsec implementation.

Re: [PATCH] xfrm: don't segment UFO packets

2016-03-18 Thread Steffen Klassert
On Fri, Mar 18, 2016 at 10:36:53AM +0800, Herbert Xu wrote: > On Thu, Mar 17, 2016 at 06:08:55PM +0100, Jiri Bohac wrote: > > On Thu, Mar 17, 2016 at 11:24:59AM +0100, Steffen Klassert wrote: > > > In IPv6 this check is missing, so this could be the > > > problem if this is IPv6. > > > > indeed, t