Maciej Żenczykowski
ba05057bd0
net/ipv4: always honour route mtu during forwarding ...
[ Upstream commit 02a1b175b0e92d9e0fa5df3957ade8d733ceb6a0 ]
Documentation/networking/ip-sysctl.txt:46 says:
ip_forward_use_pmtu - BOOLEAN
By default we don't trust protocol path MTUs while forwarding
because they could be easily forged and can lead to unwanted
fragmentation by the router.
You only need to enable this if you have user-space software
which tries to discover path mtus by itself and depends on the
kernel honoring this information. This is normally not the case.
Default: 0 (disabled)
Possible values:
0 - disabled
1 - enabled
Which makes it pretty clear that setting it to 1 is a potential
security/safety/DoS issue, and yet it is entirely reasonable to want
forwarded traffic to honour explicitly administrator configured
route mtus (instead of defaulting to device mtu).
Indeed, I can't think of a single reason why you wouldn't want to.
Since you configured a route mtu you probably know better...
It is pretty common to have a higher device mtu to allow receiving
large (jumbo) frames, while having some routes via that interface
(potentially including the default route to the internet) specify
a lower mtu.
Note that ipv6 forwarding uses device mtu unless the route is locked
(in which case it will use the route mtu).
This approach is not usable for IPv4 where an 'mtu lock' on a route
also has the side effect of disabling TCP path mtu discovery via
disabling the IPv4 DF (don't frag) bit on all outgoing frames.
I'm not aware of a way to lock a route from an IPv6 RA, so that also
potentially seems wrong.
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Sunmeet Gill (Sunny) <sgill@quicinc.com>
Cc: Vinay Paradkar <vparadka@qti.qualcomm.com>
Cc: Tyler Wear <twear@quicinc.com>
Cc: David Ahern <dsahern@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-29 09:57:24 +01:00
Bluetooth: Disconnect if E0 is used for Level 4
2020-10-17 10:11:22 +02:00
netfilter: nf_tables: fix destination register zeroing
2020-09-09 19:12:24 +02:00
netfilter: nf_tables: autoload modules from the abort path
2020-01-29 16:45:33 +01:00
net: sctp: Fix IPv6 ancestor_size calc in sctp_copy_descendant
2020-09-26 18:03:13 +02:00
net: sched: take reference to psample group in flow_action infra
2019-09-16 09:18:03 +02:00
net_sched: defer tcf_idr_insert() in tcf_action_init_1()
2020-10-14 10:33:06 +02:00
ipv6: fix memory leaks on IPV6_ADDRFORM path
2020-08-11 15:33:39 +02:00
rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
2020-09-09 19:12:23 +02:00
net: avoid potential false sharing in neighbor related code
2019-12-31 16:45:03 +01:00
bonding: fix state transition issue in link monitoring
2019-11-05 17:40:16 -08:00
net: annotate lockless accesses to sk->sk_napi_id
2019-10-30 17:34:35 -07:00
cfg80211: Fix radar event during another phy CAC
2020-02-05 21:22:46 +00:00
devlink: disallow reload operation during device cleanup
2019-11-09 19:38:36 -08:00
net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report()
2020-05-27 17:46:24 +02:00
net: dsa: Pass ndo_setup_tc slave callback to drivers
2019-09-16 21:32:57 +02:00
net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
2020-07-22 09:32:47 +02:00
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:18:58 +01:00
fib: add missing attribute validation for tun_id
2020-03-18 07:17:44 +01:00
ipv4: Initialize flowi4_multipath_hash in data path
2020-09-26 18:03:12 +02:00
net: sched: correct flower port blocking
2020-03-05 16:43:32 +01:00
net: core: rename indirect block ingress cb function
2019-12-18 16:08:47 +01:00
net/flow_dissector: switch to siphash
2019-10-23 20:13:22 -07:00
net/fq_impl: Switch to kvmalloc() for memory allocation
2019-11-08 09:11:49 +01:00
genetlink: remove genl_bind
2020-07-22 09:32:46 +02:00
net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static
2019-10-25 16:24:32 -07:00
net: refactor bind_bucket fastreuse into helper
2020-08-19 08:16:23 +02:00
sched: consistently handle layer3 header accesses in the presence of VLANs
2020-07-22 09:32:48 +02:00
dccp: Fix possible memleak in dccp_init and dccp_fini
2020-06-17 16:40:32 +02:00
ip: support SO_MARK cmsg
2019-09-13 21:44:19 +02:00
tcp: honor SO_PRIORITY in TIME_WAIT state
2019-09-27 12:05:02 +02:00
net/ipv4: always honour route mtu during forwarding
2020-10-29 09:57:24 +01:00
ipv6: Use global sernum for dst validation with nexthop objects
2020-05-14 07:58:20 +02:00
net: ipv6: do not consider routes via gateways for anycast address check
2020-04-21 09:04:45 +02:00
ipv4: nexthop version of fib_info_nh_uses_dev
2020-06-03 08:21:37 +02:00
ipvs: allow connection reuse for unconfirmed conntrack
2020-08-19 08:16:10 +02:00
net: ipv6: add net argument to ip6_dst_lookup_flow
2019-12-18 16:08:40 +01:00
net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
2019-12-18 16:08:42 +01:00
bonding/alb: properly access headers in bond_alb_xmit()
2020-02-11 04:35:48 -08:00
llc: fix sk_buff leak in llc_conn_service()
2019-10-08 13:23:05 -07:00
mac80211: populate debugfs only after cfg80211 init
2020-04-29 16:33:18 +02:00
net: avoid potential false sharing in neighbor related code
2019-12-31 16:45:03 +01:00
net: add annotations on hh->hh_len lockless accesses
2020-01-09 10:20:06 +01:00
ipv6: Use global sernum for dst validation with nexthop objects
2020-05-14 07:58:20 +02:00
ipv4: nexthop version of fib_info_nh_uses_dev
2020-06-03 08:21:37 +02:00
page_pool: do not release pool until inflight == 0.
2019-12-18 16:09:07 +01:00
net_sched: fix ops->bind_class() implementations
2020-02-01 09:34:38 +00:00
sched: consistently handle layer3 header accesses in the presence of VLANs
2020-07-22 09:32:48 +02:00
net: sched: take reference to psample group in flow_action infra
2019-09-16 09:18:03 +02:00
net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head
2019-10-09 21:34:31 -07:00
ipv4: Revert removal of rt_uses_gateway
2019-09-20 18:23:33 -07:00
net_sched: fix tcm_parent in tc filter dump
2020-05-20 08:20:07 +02:00
net: silence data-races on sk_backlog.tail
2020-10-01 13:17:15 +02:00
udp: correct reuseport selection with connected sockets
2019-09-16 09:02:18 +02:00
tcp: correct read of TFO keys on big endian systems
2020-08-19 08:16:23 +02:00
bpf: Fix running sk_skb program types with ktls
2020-06-22 09:31:12 +02:00
udp: document udp_rcv_segment special case for looped packets
2020-05-10 10:31:33 +02:00
vxlan: add adjacent link to limit depth level
2019-10-24 14:53:49 -07:00
page_pool: do not release pool until inflight == 0.
2019-12-18 16:09:07 +01:00
xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate
2020-10-14 10:33:02 +02:00
ba05057bd0