]> Git Repo - linux.git/commit - net/xfrm/xfrm_state.c
Revert "xfrm: xfrm_state_mtu should return at least 1280 for ipv6"
authorJiri Bohac <[email protected]>
Wed, 26 Jan 2022 15:00:18 +0000 (16:00 +0100)
committerSteffen Klassert <[email protected]>
Thu, 27 Jan 2022 06:34:06 +0000 (07:34 +0100)
commita6d95c5a628a09be129f25d5663a7e9db8261f51
tree3f6bc5a2ff4abde673736d2d3fd088e6cefb384e
parente03c3bba351f99ad932e8f06baa9da1afc418e02
Revert "xfrm: xfrm_state_mtu should return at least 1280 for ipv6"

This reverts commit b515d2637276a3810d6595e10ab02c13bfd0b63a.

Commit b515d2637276a3810d6595e10ab02c13bfd0b63a ("xfrm: xfrm_state_mtu
should return at least 1280 for ipv6") in v5.14 breaks the TCP MSS
calculation in ipsec transport mode, resulting complete stalls of TCP
connections. This happens when the (P)MTU is 1280 or slighly larger.

The desired formula for the MSS is:
MSS = (MTU - ESP_overhead) - IP header - TCP header

However, the above commit clamps the (MTU - ESP_overhead) to a
minimum of 1280, turning the formula into
MSS = max(MTU - ESP overhead, 1280) -  IP header - TCP header

With the (P)MTU near 1280, the calculated MSS is too large and the
resulting TCP packets never make it to the destination because they
are over the actual PMTU.

The above commit also causes suboptimal double fragmentation in
xfrm tunnel mode, as described in
https://lore.kernel.org/netdev/20210429202529[email protected]/

The original problem the above commit was trying to fix is now fixed
by commit 6596a0229541270fb8d38d989f91b78838e5e9da ("xfrm: fix MTU
regression").

Signed-off-by: Jiri Bohac <[email protected]>
Signed-off-by: Steffen Klassert <[email protected]>
include/net/xfrm.h
net/ipv4/esp4.c
net/ipv6/esp6.c
net/xfrm/xfrm_state.c
This page took 0.087086 seconds and 4 git commands to generate.