[PATCH] bridge: send correct MTU value in PMTU - Kernel

This is a discussion on [PATCH] bridge: send correct MTU value in PMTU - Kernel ; When bridging interfaces with different MTUs, the bridge correctly chooses the minimum of the MTUs of the physical devices as the bridges MTU. But when a frame is passed which fits through the incoming, but not through the outgoing interface, ...

+ Reply to Thread
Results 1 to 4 of 4

Thread: [PATCH] bridge: send correct MTU value in PMTU

  1. [PATCH] bridge: send correct MTU value in PMTU

    When bridging interfaces with different MTUs, the bridge correctly
    chooses
    the minimum of the MTUs of the physical devices as the bridges MTU. But
    when a frame is passed which fits through the incoming, but not through
    the
    outgoing interface, a "Fragmentation Needed" packet is generated.
    However, the propagated MTU is hardcoded to 1500, which is wrong in this
    situation. The sender will repeat the packet again with the same frame
    size,
    and the same problem will occur again.

    Instead of sending 1500, the (correct) MTU value of the bridge is now
    sent via PMTU. To achieve this, the corresponding rtable structure is
    stored in its net_bridge structure.

    Signed-off-by: Simon Wunderlich
    ---
    net/bridge/br_device.c | 5 ++++-
    net/bridge/br_if.c | 31 +++++++++++++++++++++++++++++++
    net/bridge/br_netfilter.c | 45 ++++++++++++---------------------------------
    net/bridge/br_private.h | 4 ++++
    4 files changed, 51 insertions(+), 34 deletions(-)

    diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
    index bf77873..a52075b 100644
    --- a/net/bridge/br_device.c
    +++ b/net/bridge/br_device.c
    @@ -76,10 +76,13 @@ static int br_dev_stop(struct net_device *dev)

    static int br_change_mtu(struct net_device *dev, int new_mtu)
    {
    - if (new_mtu < 68 || new_mtu > br_min_mtu(netdev_priv(dev)))
    + struct net_bridge *br = netdev_priv(dev);
    + if (new_mtu < 68 || new_mtu > br_min_mtu(br))
    return -EINVAL;

    dev->mtu = new_mtu;
    + /* remember the MTU in the rtable for PMTU */
    + br->fake_rtable.u.dst.metrics[RTAX_MTU - 1] = new_mtu;
    return 0;
    }

    diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
    index f38cc53..b8d438d 100644
    --- a/net/bridge/br_if.c
    +++ b/net/bridge/br_if.c
    @@ -170,6 +170,34 @@ static void del_br(struct net_bridge *br)
    unregister_netdevice(br->dev);
    }

    +/* We need these fake structures to make netfilter happy --
    + * lots of places assume that skb->dst != NULL, which isn't
    + * all that unreasonable.
    + *
    + * Currently, we fill in the PMTU entry because netfilter
    + * refragmentation needs it, and the rt_flags entry because
    + * ipt_REJECT needs it. Future netfilter modules might
    + * require us to fill additional fields. */
    +struct net_device __fake_net_device = {
    + .hard_header_len = ETH_HLEN,
    +#ifdef CONFIG_NET_NS
    + .nd_net = &init_net,
    +#endif
    +};
    +
    +struct rtable __fake_rtable = {
    + .u = {
    + .dst = {
    + .__refcnt = ATOMIC_INIT(1),
    + .dev = &__fake_net_device,
    + .path = &__fake_rtable.u.dst,
    + .metrics = {[RTAX_MTU - 1] = 1500},
    + .flags = DST_NOXFRM,
    + }
    + },
    + .rt_flags = 0,
    +};
    +
    static struct net_device *new_bridge_dev(const char *name)
    {
    struct net_bridge *br;
    @@ -204,6 +232,9 @@ static struct net_device *new_bridge_dev(const char *name)
    br->topology_change = 0;
    br->topology_change_detected = 0;
    br->ageing_time = 300 * HZ;
    + memcpy(&br->fake_rtable, &__fake_rtable, sizeof(__fake_rtable));
    + br->fake_rtable.u.dst.path = &br->fake_rtable.u.dst;
    +
    INIT_LIST_HEAD(&br->age_list);

    br_stp_timer_init(br);
    diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
    index bb90cd7..9d6a578 100644
    --- a/net/bridge/br_netfilter.c
    +++ b/net/bridge/br_netfilter.c
    @@ -101,33 +101,12 @@ static inline __be16 pppoe_proto(const struct sk_buff*skb)
    pppoe_proto(skb) == htons(PPP_IPV6) && \
    brnf_filter_pppoe_tagged)

    -/* We need these fake structures to make netfilter happy --
    - * lots of places assume that skb->dst != NULL, which isn't
    - * all that unreasonable.
    - *
    - * Currently, we fill in the PMTU entry because netfilter
    - * refragmentation needs it, and the rt_flags entry because
    - * ipt_REJECT needs it. Future netfilter modules might
    - * require us to fill additional fields. */
    -static struct net_device __fake_net_device = {
    - .hard_header_len = ETH_HLEN,
    -#ifdef CONFIG_NET_NS
    - .nd_net = &init_net,
    -#endif
    -};
    +static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
    +{
    + struct net_bridge_port *port = rcu_dereference(dev->br_port);

    -static struct rtable __fake_rtable = {
    - .u = {
    - .dst = {
    - .__refcnt = ATOMIC_INIT(1),
    - .dev = &__fake_net_device,
    - .path = &__fake_rtable.u.dst,
    - .metrics = {[RTAX_MTU - 1] = 1500},
    - .flags = DST_NOXFRM,
    - }
    - },
    - .rt_flags = 0,
    -};
    + return port ? &port->br->fake_rtable: &__fake_rtable;
    +}

    static inline struct net_device *bridge_parent(const struct net_device *dev)
    {
    @@ -226,8 +205,8 @@ static int br_nf_pre_routing_finish_ipv6(struct sk_buff*skb)
    }
    nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;

    - skb->rtable = &__fake_rtable;
    - dst_hold(&__fake_rtable.u.dst);
    + skb->rtable = bridge_parent_rtable(nf_bridge->physindev);
    + dst_hold(&skb->rtable->u.dst);

    skb->dev = nf_bridge->physindev;
    nf_bridge_push_encap_header(skb);
    @@ -391,8 +370,8 @@ bridged_dnat:
    skb->pkt_type = PACKET_HOST;
    }
    } else {
    - skb->rtable = &__fake_rtable;
    - dst_hold(&__fake_rtable.u.dst);
    + skb->rtable = bridge_parent_rtable(nf_bridge->physindev);
    + dst_hold(&skb->rtable->u.dst);
    }

    skb->dev = nf_bridge->physindev;
    @@ -611,8 +590,8 @@ static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff *skb,
    const struct net_device *out,
    int (*okfn)(struct sk_buff *))
    {
    - if (skb->rtable == &__fake_rtable) {
    - dst_release(&__fake_rtable.u.dst);
    + if (skb->rtable == bridge_parent_rtable(in)) {
    + dst_release(&skb->rtable->u.dst);
    skb->rtable = NULL;
    }

    diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
    index c11b554..c0e9a7e 100644
    --- a/net/bridge/br_private.h
    +++ b/net/bridge/br_private.h
    @@ -17,6 +17,7 @@

    #include
    #include
    +#include /* struct rtable, RTAX_MTU */

    #define BR_HASH_BITS 8
    #define BR_HASH_SIZE (1 << BR_HASH_BITS)
    @@ -95,6 +96,7 @@ struct net_bridge
    struct hlist_head hash[BR_HASH_SIZE];
    struct list_head age_list;
    unsigned long feature_mask;
    + struct rtable fake_rtable;

    /* STP */
    bridge_id designated_root;
    @@ -202,6 +204,8 @@ extern void br_netfilter_fini(void);
    #define br_netfilter_init() (0)
    #define br_netfilter_fini() do { } while(0)
    #endif
    +extern struct rtable __fake_rtable;
    +extern struct net_device __fake_net_device;

    /* br_stp.c */
    extern void br_log_state(const struct net_bridge_port *p);
    --
    1.5.6.2


    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.6 (GNU/Linux)

    iD8DBQFId1Znrzg/fFk7axYRAnahAJ9M0RHjlvq37QjkpmFAeSFEeZx6wgCfeokq
    Jp/CYvUBY/M6Lttwa5OpC8g=
    =VsJ8
    -----END PGP SIGNATURE-----


  2. Re: [PATCH] bridge: send correct MTU value in PMTU

    On Fri, 11 Jul 2008 14:47:35 +0200
    Simon Wunderlich wrote:

    > When bridging interfaces with different MTUs, the bridge correctly
    > chooses
    > the minimum of the MTUs of the physical devices as the bridges MTU. But
    > when a frame is passed which fits through the incoming, but not through
    > the
    > outgoing interface, a "Fragmentation Needed" packet is generated.
    > However, the propagated MTU is hardcoded to 1500, which is wrong in this
    > situation. The sender will repeat the packet again with the same frame
    > size,
    > and the same problem will occur again.
    >
    > Instead of sending 1500, the (correct) MTU value of the bridge is now
    > sent via PMTU. To achieve this, the corresponding rtable structure is
    > stored in its net_bridge structure.
    >
    > Signed-off-by: Simon Wunderlich
    > ---
    > net/bridge/br_device.c | 5 ++++-
    > net/bridge/br_if.c | 31 +++++++++++++++++++++++++++++++
    > net/bridge/br_netfilter.c | 45 ++++++++++++---------------------------------
    > net/bridge/br_private.h | 4 ++++
    > 4 files changed, 51 insertions(+), 34 deletions(-)
    >
    > diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
    > index bf77873..a52075b 100644
    > --- a/net/bridge/br_device.c
    > +++ b/net/bridge/br_device.c
    > @@ -76,10 +76,13 @@ static int br_dev_stop(struct net_device *dev)
    >
    > static int br_change_mtu(struct net_device *dev, int new_mtu)
    > {
    > - if (new_mtu < 68 || new_mtu > br_min_mtu(netdev_priv(dev)))
    > + struct net_bridge *br = netdev_priv(dev);
    > + if (new_mtu < 68 || new_mtu > br_min_mtu(br))
    > return -EINVAL;
    >
    > dev->mtu = new_mtu;
    > + /* remember the MTU in the rtable for PMTU */
    > + br->fake_rtable.u.dst.metrics[RTAX_MTU - 1] = new_mtu;
    > return 0;
    > }
    >
    > diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
    > index f38cc53..b8d438d 100644
    > --- a/net/bridge/br_if.c
    > +++ b/net/bridge/br_if.c
    > @@ -170,6 +170,34 @@ static void del_br(struct net_bridge *br)
    > unregister_netdevice(br->dev);
    > }
    >
    > +/* We need these fake structures to make netfilter happy --
    > + * lots of places assume that skb->dst != NULL, which isn't
    > + * all that unreasonable.
    > + *
    > + * Currently, we fill in the PMTU entry because netfilter
    > + * refragmentation needs it, and the rt_flags entry because
    > + * ipt_REJECT needs it. Future netfilter modules might
    > + * require us to fill additional fields. */
    > +struct net_device __fake_net_device = {
    > + .hard_header_len = ETH_HLEN,
    > +#ifdef CONFIG_NET_NS
    > + .nd_net = &init_net,
    > +#endif
    > +};
    > +
    > +struct rtable __fake_rtable = {
    > + .u = {
    > + .dst = {
    > + .__refcnt = ATOMIC_INIT(1),
    > + .dev = &__fake_net_device,
    > + .path = &__fake_rtable.u.dst,
    > + .metrics = {[RTAX_MTU - 1] = 1500},
    > + .flags = DST_NOXFRM,
    > + }
    > + },
    > + .rt_flags = 0,
    > +};
    > +
    > static struct net_device *new_bridge_dev(const char *name)
    > {
    > struct net_bridge *br;
    > @@ -204,6 +232,9 @@ static struct net_device *new_bridge_dev(const char *name)
    > br->topology_change = 0;
    > br->topology_change_detected = 0;
    > br->ageing_time = 300 * HZ;
    > + memcpy(&br->fake_rtable, &__fake_rtable, sizeof(__fake_rtable));
    > + br->fake_rtable.u.dst.path = &br->fake_rtable.u.dst;
    > +
    > INIT_LIST_HEAD(&br->age_list);
    >
    > br_stp_timer_init(br);
    > diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
    > index bb90cd7..9d6a578 100644
    > --- a/net/bridge/br_netfilter.c
    > +++ b/net/bridge/br_netfilter.c
    > @@ -101,33 +101,12 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb)
    > pppoe_proto(skb) == htons(PPP_IPV6) && \
    > brnf_filter_pppoe_tagged)
    >
    > -/* We need these fake structures to make netfilter happy --
    > - * lots of places assume that skb->dst != NULL, which isn't
    > - * all that unreasonable.
    > - *
    > - * Currently, we fill in the PMTU entry because netfilter
    > - * refragmentation needs it, and the rt_flags entry because
    > - * ipt_REJECT needs it. Future netfilter modules might
    > - * require us to fill additional fields. */
    > -static struct net_device __fake_net_device = {
    > - .hard_header_len = ETH_HLEN,
    > -#ifdef CONFIG_NET_NS
    > - .nd_net = &init_net,
    > -#endif
    > -};
    > +static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
    > +{
    > + struct net_bridge_port *port = rcu_dereference(dev->br_port);
    >
    > -static struct rtable __fake_rtable = {
    > - .u = {
    > - .dst = {
    > - .__refcnt = ATOMIC_INIT(1),
    > - .dev = &__fake_net_device,
    > - .path = &__fake_rtable.u.dst,
    > - .metrics = {[RTAX_MTU - 1] = 1500},
    > - .flags = DST_NOXFRM,
    > - }
    > - },
    > - .rt_flags = 0,
    > -};
    > + return port ? &port->br->fake_rtable: &__fake_rtable;
    > +}



    port should always be non-null so the existing fake_rtable can
    just go away no?

    Also some of this could be #ifdef CONFIG_BRNETFILTER
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

  3. Re: [PATCH] bridge: send correct MTU value in PMTU

    On Fri, Jul 11, 2008 at 08:34:23AM -0700, Stephen Hemminger wrote:
    > On Fri, 11 Jul 2008 14:47:35 +0200
    > Simon Wunderlich wrote:
    >
    > > [...]

    >
    >
    > port should always be non-null so the existing fake_rtable can
    > just go away no?


    I wondered about that too. But since bridge_parent() is also checking port
    for NULL, and the code calling this is carefully checking these cases, i
    assumed that this is quite possible. If you can assert that port is
    non-NULL, we can remove this, but i have to admit that i don't get the
    whole picture to be sure about this.

    >
    > Also some of this could be #ifdef CONFIG_BRNETFILTER


    Thanks, you're right. I will prepare the patch again with some #ifdefs.

    regards,
    Simon

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.6 (GNU/Linux)

    iD8DBQFId5Ymrzg/fFk7axYRAr5EAJ9zm9U/mnvWlEexz2Wtx6pNu3H9QACg0t4S
    kovqWcfGFCxpkJA8wGVd60g=
    =Nqm4
    -----END PGP SIGNATURE-----


  4. Re: [PATCH] bridge: send correct MTU value in PMTU

    On Fri, 11 Jul 2008 19:19:35 +0200
    Simon Wunderlich wrote:

    > On Fri, Jul 11, 2008 at 08:34:23AM -0700, Stephen Hemminger wrote:
    > > On Fri, 11 Jul 2008 14:47:35 +0200
    > > Simon Wunderlich wrote:
    > >
    > > > [...]

    > >
    > >
    > > port should always be non-null so the existing fake_rtable can
    > > just go away no?

    >
    > I wondered about that too. But since bridge_parent() is also checking port
    > for NULL, and the code calling this is carefully checking these cases, i
    > assumed that this is quite possible. If you can assert that port is
    > non-NULL, we can remove this, but i have to admit that i don't get the
    > whole picture to be sure about this.


    bridge_parent can only be NULL if the bridge is process of deletion (via RCU).
    So if bridge_parent() returns NULL, code should not bother with further processing
    and return (dropping skb if this function does that).

    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

+ Reply to Thread