Maciej Żenczykowski
47e4106798
net/ipv4: always honour route mtu during forwarding ...
[ Upstream commit 02a1b175b0e92d9e0fa5df3957ade8d733ceb6a0 ]
Documentation/networking/ip-sysctl.txt:46 says:
ip_forward_use_pmtu - BOOLEAN
By default we don't trust protocol path MTUs while forwarding
because they could be easily forged and can lead to unwanted
fragmentation by the router.
You only need to enable this if you have user-space software
which tries to discover path mtus by itself and depends on the
kernel honoring this information. This is normally not the case.
Default: 0 (disabled)
Possible values:
0 - disabled
1 - enabled
Which makes it pretty clear that setting it to 1 is a potential
security/safety/DoS issue, and yet it is entirely reasonable to want
forwarded traffic to honour explicitly administrator configured
route mtus (instead of defaulting to device mtu).
Indeed, I can't think of a single reason why you wouldn't want to.
Since you configured a route mtu you probably know better...
It is pretty common to have a higher device mtu to allow receiving
large (jumbo) frames, while having some routes via that interface
(potentially including the default route to the internet) specify
a lower mtu.
Note that ipv6 forwarding uses device mtu unless the route is locked
(in which case it will use the route mtu).
This approach is not usable for IPv4 where an 'mtu lock' on a route
also has the side effect of disabling TCP path mtu discovery via
disabling the IPv4 DF (don't frag) bit on all outgoing frames.
I'm not aware of a way to lock a route from an IPv6 RA, so that also
potentially seems wrong.
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Sunmeet Gill (Sunny) <sgill@quicinc.com>
Cc: Vinay Paradkar <vparadka@qti.qualcomm.com>
Cc: Tyler Wear <twear@quicinc.com>
Cc: David Ahern <dsahern@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-29 09:05:31 +01:00
Bluetooth: Disconnect if E0 is used for Level 4
2020-10-17 11:02:19 +02:00
caif: reduce stack size with KASAN
2019-05-08 07:19:07 +02:00
s390/iucv: do not use arrays as argument
2015-09-21 16:03:04 -07:00
netfilter: nf_tables: fix destination register zeroing
2020-09-12 11:47:33 +02:00
inet: switch IP ID generator to siphash
2019-08-25 10:51:42 +02:00
NFC: Fix the number of pipes
2018-09-29 03:07:30 -07:00
phonet: fix building with clang
2019-03-23 13:19:44 +01:00
sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket
2020-06-30 15:38:39 -04:00
net/sched: act_tunnel_key: fix NULL dereference when 'goto chain' is used
2018-08-24 13:12:37 +02:00
6lowpan: add 802.15.4 short addr slaac
2016-06-15 20:41:22 -07:00
net sched: fix reporting the first-time use timestamp
2020-06-03 08:16:25 +02:00
ipv6: fix memory leaks on IPV6_ADDRFORM path
2020-08-21 11:01:55 +02:00
ieee802154: af_ieee802154: fix typo in comment.
2015-09-17 13:20:05 +02:00
rxrpc: Rewrite the data and ack handling code
2016-09-08 11:10:12 +01:00
af_unix: split 'u->readlock' into two: 'iolock' and 'bindlock'
2016-09-04 13:29:29 -07:00
vsock: split dwork to avoid reinitializations
2018-08-22 07:47:13 +02:00
ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
2019-06-11 12:22:49 +02:00
ax25: fix possible use-after-free
2019-02-23 09:05:59 +01:00
bonding: 3ad: apply ad_actor settings changes immediately
2016-02-09 04:45:49 -05:00
bonding: convert num_grat_arp to the new bonding option API
2015-07-27 01:05:24 -07:00
bonding: avoid possible dead-lock
2018-10-18 09:13:21 +02:00
net: un-inline sk_busy_loop()
2015-11-18 16:17:38 -05:00
calipso: Add a label cache.
2016-06-27 15:06:17 -04:00
cfg80211/mac80211: make ieee80211_send_layer2_update a public function
2020-01-23 08:19:34 +01:00
ieee802154: add netns support
2016-07-08 12:20:57 +02:00
csum: Update csum_block_add to use rotate instead of byteswap
2016-03-13 15:01:00 -04:00
netlabel: out of bound access in cipso_v4_validate()
2017-02-18 15:11:41 +01:00
cls_cgroup: get sk_classid only from full sockets
2016-04-19 20:09:25 -04:00
codel: split into multiple files
2016-04-25 16:44:27 -04:00
codel: split into multiple files
2016-04-25 16:44:27 -04:00
net_sched: fq_codel: cache skb->truesize into skb->cb
2016-06-25 12:19:35 -04:00
packet: compat support for sock_fprog
2016-06-09 23:41:03 -07:00
devlink: remove unused priv_size
2016-08-26 11:55:18 -07:00
netfilter: Pass net into okfn
2015-09-17 17:18:37 -07:00
net: dsa: add port fast ageing
2016-09-23 08:38:50 -04:00
net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
2020-07-22 09:10:48 +02:00
net: add dst_cache support
2016-02-16 20:21:48 -05:00
net/dst: Utility functions to build dst_metadata without supplying an skb
2016-09-10 20:53:55 -07:00
ipv4, ipv6: Pass net into __ip_local_out and __ip6_local_out
2015-10-08 04:27:02 -07:00
net/ethoc: support big-endian register layout
2015-09-23 15:33:15 -07:00
fib: add missing attribute validation for tun_id
2020-03-20 09:07:39 +01:00
net: flow: Remove FLOWI_FLAG_L3MDEV_SRC flag
2016-09-10 23:12:53 -07:00
net: sched: correct flower port blocking
2020-03-11 07:53:05 +01:00
fou: Add encap ops for IPv6 tunnels
2016-05-20 18:03:16 -04:00
net/flow_dissector: switch to siphash
2019-11-10 11:23:31 +01:00
net/flow_dissector: switch to siphash
2019-11-10 11:23:31 +01:00
net: sched: do not acquire qdisc spinlock in qdisc/class stats dump
2016-06-07 16:37:14 -07:00
genetlink: remove genl_bind
2020-07-22 09:10:48 +02:00
net: Remove deprecated tunnel specific UDP offload functions
2016-06-17 20:23:32 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2016-08-18 01:17:32 -04:00
gro_cells: make sure device is up in gro_cells_receive()
2019-03-19 13:14:10 +01:00
gtp: #define #define _GTP_H_ and not #define _GTP_H
2016-07-25 17:55:43 -07:00
net: add a hardware buffer management helper API
2016-03-14 12:19:46 -04:00
net: Add __icmp_send helper.
2019-03-13 14:04:53 -07:00
mac80211: add support for radiotap timestamp field
2016-09-12 11:45:45 +02:00
mac802154: constify ieee802154_llsec_ops structure
2016-01-04 20:40:41 +01:00
IPv6: fix DESYNC_FACTOR
2016-10-14 10:59:15 -04:00
ila: Add generic ILA translation facility
2015-12-15 23:25:20 -05:00
ipv6: remove unused in6_addr struct
2016-03-22 15:45:44 -04:00
tcp/dccp: do not touch listener sk_refcnt under synflood
2016-04-04 22:11:20 -04:00
ip4ip6: Support for GSO/GRO
2016-05-20 18:03:17 -04:00
net: refactor bind_bucket fastreuse into helper
2020-09-12 11:47:38 +02:00
ipv6: suppress sparse warnings in IP6_ECN_set_ce()
2016-08-13 15:08:00 -07:00
net: IP defrag: encapsulate rbtree defrag code into callable functions
2019-05-02 09:32:06 +02:00
tcp/dccp: fix possible race __inet_lookup_established()
2020-01-04 13:41:12 +01:00
inet: make sure to grab rcu_read_lock before using ireq->ireq_opt
2018-10-18 09:13:23 +02:00
soreuseport: initialise timewait reuseport field
2018-05-16 10:08:41 +02:00
net: ipv4: use a dedicated counter for icmp_v4 redirect packets
2019-02-23 09:05:59 +01:00
net/ipv4: always honour route mtu during forwarding
2020-10-29 09:05:31 +01:00
ipv6: Pass proto to csum_ipv6_magic as __u8 instead of unsigned short
2016-03-13 23:55:13 -04:00
ipv6: fix sparse warning on rt6i_node
2017-09-20 08:19:53 +02:00
net: ipv6: do not consider routes via gateways for anycast address check
2020-04-24 07:59:02 +02:00
ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
2019-07-21 09:05:57 +02:00
net: ipv4: Fix memory leak in network namespace dismantle
2019-01-31 08:12:33 +01:00
ip_tunnel: add collect_md mode to IPIP tunnel
2016-09-17 10:13:07 -04:00
ipvs: move old_secure_tcp into struct netns_ipvs
2019-11-12 19:15:57 +01:00
net: ipv6: add net argument to ip6_dst_lookup_flow
2020-05-20 08:15:30 +02:00
ip6: fix skb leak in ip6frag_expire_frag_queue()
2019-09-16 08:19:33 +02:00
wext: handle NULL extra data in iwe_stream_add_point better
2017-08-11 08:49:34 -07:00
kcm: Use stream parser
2016-08-17 19:36:23 -04:00
ipvlan, l3mdev: fix broken l3s mode wrt local routes
2019-02-06 17:33:27 +01:00
llc: avoid blocking in llc_sap_close()
2019-11-25 09:52:18 +01:00
llc: fix sk_buff leak in llc_conn_service()
2019-11-06 12:18:24 +01:00
lwtunnel: valid encap attr check should return 0 when lwtunnel is disabled
2017-02-18 15:11:42 +01:00
mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4
2018-05-30 07:50:28 +02:00
ieee802154: cleanup WARN_ON for fc fetch
2016-07-08 13:23:12 +02:00
openvswitch: use mpls_hdr
2016-10-03 02:00:22 -04:00
mpls: multipath route support
2015-10-23 06:26:42 -07:00
net/ncsi: Introduce ncsi_stop_dev()
2016-10-04 02:11:51 -04:00
6lowpan: introduce 6lowpan-nd
2016-06-15 20:41:23 -07:00
net: add annotations on hh->hh_len lockless accesses
2020-01-12 11:24:19 +01:00
netns: provide pure entropy for net_hash_mix()
2019-04-17 08:36:46 +02:00
neigh: Send a notification when DELAY_PROBE_TIME changes
2016-07-05 09:06:29 -07:00
netlabel: Implement CALIPSO config functions for SMACK.
2016-06-27 15:06:18 -04:00
netlink: fix nla_put_{u8,u16,u32} for KASAN
2017-10-12 11:51:25 +02:00
net: wrap sock->sk_cgrp_prioidx and ->sk_classid inside a struct
2015-12-08 22:02:33 -05:00
net: fix rtnh_ok()
2018-05-16 10:08:41 +02:00
ieee802154: add netns support
2016-07-08 12:20:57 +02:00
net: ping: make ping_v6_sendmsg static
2016-03-23 22:09:58 -04:00
net/sched: pkt_cls: change tc actions order to be as the user sets
2016-09-28 05:02:44 -04:00
net: sched: convert qdisc linked list to hashtable
2016-08-10 17:19:02 -07:00
pptp: Refactor the struct and macros of PPTP codes
2016-08-15 10:55:53 -07:00
udp: Remove udp_offloads
2016-04-07 16:53:30 -04:00
sock: struct proto hash function may error
2016-02-11 03:54:14 -05:00
net_sched: red: Avoid illegal values
2018-02-25 11:05:48 +01:00
regulatory: add NUL to request alpha2
2018-05-30 07:50:30 +02:00
inet: reqsk_alloc() needs to take care of dead listeners
2016-04-04 22:11:19 -04:00
ipv4: lock mtu in fnhe when received PMTU < net.ipv4.route.min_pmtu
2018-05-30 07:50:36 +02:00
net: rtnetlink: add support for the IFLA_STATS_LINK_XSTATS_SLAVE attribute
2016-06-30 06:15:04 -04:00
sch_netem: fix rcu splat in netem_enqueue()
2019-11-06 12:18:25 +01:00
unix: correctly track in-flight fds in sending process user_struct
2016-02-08 10:30:42 -05:00
slip: Check if rstate is initialized before uncompressing
2018-04-20 08:21:07 +02:00
net: snmp: fix 64bit stats on 32bit arches
2016-04-28 11:49:45 -04:00
net/compat: Add missing sock updates for SCM_RIGHTS
2020-08-21 11:02:08 +02:00
soreuseport: fix NULL ptr dereference SO_REUSEPORT after bind
2016-01-19 14:44:23 -05:00
kcm: Remove TCP specific references from kcm and strparser
2016-08-28 23:32:41 -04:00
switchdev: remove FIB offload infrastructure
2016-09-28 04:48:00 -04:00
tcp: cache line align MAX_TCP_HEADER
2020-05-02 17:23:08 +02:00
inet: remove BUG_ON() in twsk_destructor()
2015-07-09 15:12:20 -07:00
ipv6: add new struct ipcm6_cookie
2016-05-03 16:08:14 -04:00
net: tso: add support for IPv6
2015-10-26 22:24:22 -07:00
udp: must lock the socket in udp_disconnect()
2016-10-20 14:45:52 -04:00
vxlan: Add new UDP encapsulation offload type for VXLAN-GPE
2016-06-17 20:23:32 -07:00
udplite: fix partial checksum initialization
2018-03-11 16:21:32 +01:00
vxlan: fix hlist corruption
2017-07-21 07:42:18 +02:00
net: x25: fix one potential use-after-free issue
2018-04-13 19:48:00 +02:00
xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate
2020-10-14 09:48:16 +02:00
47e4106798