Skip to content
Commit a6d95c5a authored by Jiri Bohac's avatar Jiri Bohac Committed by Steffen Klassert
Browse files

Revert "xfrm: xfrm_state_mtu should return at least 1280 for ipv6"

This reverts commit b515d263.

Commit b515d263 ("xfrm: xfrm_state_mtu
should return at least 1280 for ipv6") in v5.14 breaks the TCP MSS
calculation in ipsec transport mode, resulting complete stalls of TCP
connections. This happens when the (P)MTU is 1280 or slighly larger.

The desired formula for the MSS is:
MSS = (MTU - ESP_overhead) - IP header - TCP header

However, the above commit clamps the (MTU - ESP_overhead) to a
minimum of 1280, turning the formula into
MSS = max(MTU - ESP overhead, 1280) -  IP header - TCP header

With the (P)MTU near 1280, the calculated MSS is too large and the
resulting TCP packets never make it to the destination because they
are over the actual PMTU.

The above commit also causes suboptimal double fragmentation in
xfrm tunnel mode, as described in
https://lore.kernel.org/netdev/20210429202529.codhwpc7w6kbudug@dwarf.suse.cz/

The original problem the above commit was trying to fix is now fixed
by commit 6596a022

 ("xfrm: fix MTU
regression").

Signed-off-by: default avatarJiri Bohac <jbohac@suse.cz>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent e03c3bba
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment