Re: DF (Don't frag) issues

Andre Oppermann wrote:

>David Malone wrote:
>  
>
>>On Sat, Apr 23, 2005 at 10:27:53PM +1000, Matthew Sullivan wrote:
>>    
>>
>>>Ok well thanks to Andrew _at_ Supernews and a lot of debugging it appears
>>>there is a bug....
>>>
>>>sys/netinet/ip_icmp.c: line 440
>>>                       if (!mtu)
>>>                               mtu = ip_next_mtu(mtu, 1);
>>>Problem is ip_next_mtu will always return 0 when called with (0, 1) ...
>>>      
>>>
>>I think this might be a bug, but Andre would know better.  Andre -
>>it looks to me as if the first argument to ip_next_mtu here should
>>be the current MTU for the path, but it is being set to the mtu
>>from the ICMP message, which (in this case) is zero.
>>    
>>
>
>This is a bug indeed.  Let me think how to fix this most efficiently...
>
>  
>
>>(This is in the code that has just been moved to tcp_ctlinput.)
>>
>>    
>>
>>>Apparently the gateway should be suggesting a MTU value for use.... the
>>>gateway is also FreeBSD 5.3 so something needs fixing .. :-/
>>>      
>>>
>>Are you using ip fast forwarding on the gateway? It calculates the
>>size that is put into the ICMP message in a slightly different way
>>to the other forwrd path.
>>    
>>
>
>The quoted code above is used only for incoming ICMP packets.  It
>does not generate them?  What is the problem being observed exactly?
>
>  
>
As David suggested my config is shown here:

http://lists.freebsd.org/pipermail/freebsd-current/2005-April/048980.html

After talking with people I see 2 issues.....

1/ The bug is being triggered when the incoming 'need frag' ICMP message 
doesn't have a suggested value.

This ICMP message is being generated by 'stealth.sorbs.net' which is a 
FreeBSD 5.3 p9 server running FAST_IPSEC (no crypto card yet - waiting 
for delivery), and otherwise pretty standard kernel. As for fast forwarding:

net.inet.ip.fastforwarding: 0

2/ The bug itself is also a problem, as it cannot be guarenteed that the 
host returning the ICMP 'need frag' will fill in a suggested mtu, so 
that also needs to be looked at (but I guess you know that already ;-))

Regards,

Mat

-- 
Matthew Sullivan
Specialist Systems Programmer
Information Technology Services
The University of Queensland