aboutsummaryrefslogtreecommitdiffstats
path: root/net/ipv6
diff options
context:
space:
mode:
authorHerbert Xu <herbert@gondor.apana.org.au>2008-02-12 21:07:27 -0500
committerDavid S. Miller <davem@davemloft.net>2008-02-12 21:07:27 -0500
commit28a89453b1e8de8d777ad96fa1eef27b5d1ce074 (patch)
tree3dd9cc9d9c402f1191df99937897e150f3d4e724 /net/ipv6
parent69cc64d8d92bf852f933e90c888dfff083bd4fc9 (diff)
[IPV6]: Fix IPsec datagram fragmentation
This is a long-standing bug in the IPsec IPv6 code that breaks when we emit a IPsec tunnel-mode datagram packet. The problem is that the code the emits the packet assumes the IPv6 stack will fragment it later, but the IPv6 stack assumes that whoever is emitting the packet is going to pre-fragment the packet. In the long term we need to fix both sides, e.g., to get the datagram code to pre-fragment as well as to get the IPv6 stack to fragment locally generated tunnel-mode packet. For now this patch does the second part which should make it work for the IPsec host case. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
-rw-r--r--net/ipv6/ip6_output.c6
-rw-r--r--net/ipv6/xfrm6_output.c2
2 files changed, 6 insertions, 2 deletions
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 9ac6ca2521c3..4e9a2fe2f12c 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -621,7 +621,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
621 * or if the skb it not generated by a local socket. (This last 621 * or if the skb it not generated by a local socket. (This last
622 * check should be redundant, but it's free.) 622 * check should be redundant, but it's free.)
623 */ 623 */
624 if (!np || np->pmtudisc >= IPV6_PMTUDISC_DO) { 624 if (skb->local_df) {
625 skb->dev = skb->dst->dev; 625 skb->dev = skb->dst->dev;
626 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev); 626 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
627 IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS); 627 IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
@@ -1420,6 +1420,10 @@ int ip6_push_pending_frames(struct sock *sk)
1420 tmp_skb->sk = NULL; 1420 tmp_skb->sk = NULL;
1421 } 1421 }
1422 1422
1423 /* Allow local fragmentation. */
1424 if (np->pmtudisc >= IPV6_PMTUDISC_DO)
1425 skb->local_df = 1;
1426
1423 ipv6_addr_copy(final_dst, &fl->fl6_dst); 1427 ipv6_addr_copy(final_dst, &fl->fl6_dst);
1424 __skb_pull(skb, skb_network_header_len(skb)); 1428 __skb_pull(skb, skb_network_header_len(skb));
1425 if (opt && opt->opt_flen) 1429 if (opt && opt->opt_flen)
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index b34c58c65656..79ccfb080733 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -36,7 +36,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
36 if (mtu < IPV6_MIN_MTU) 36 if (mtu < IPV6_MIN_MTU)
37 mtu = IPV6_MIN_MTU; 37 mtu = IPV6_MIN_MTU;
38 38
39 if (skb->len > mtu) { 39 if (!skb->local_df && skb->len > mtu) {
40 skb->dev = dst->dev; 40 skb->dev = dst->dev;
41 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev); 41 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
42 ret = -EMSGSIZE; 42 ret = -EMSGSIZE;