Re: DF (Don't frag) issues

Matthew Sullivan wrote:
> 
> Andre Oppermann wrote:
> 
> >David Malone wrote:
> >
> >
> >>On Sat, Apr 23, 2005 at 10:27:53PM +1000, Matthew Sullivan wrote:
> >>
> >>
> >>>Ok well thanks to Andrew _at_ Supernews and a lot of debugging it appears
> >>>there is a bug....
> >>>
> >>>sys/netinet/ip_icmp.c: line 440
> >>>                       if (!mtu)
> >>>                               mtu = ip_next_mtu(mtu, 1);
> >>>Problem is ip_next_mtu will always return 0 when called with (0, 1) ...
> >>>
> >>>
> >>I think this might be a bug, but Andre would know better.  Andre -
> >>it looks to me as if the first argument to ip_next_mtu here should
> >>be the current MTU for the path, but it is being set to the mtu
> >>from the ICMP message, which (in this case) is zero.
> >>
> >>
> >
> >This is a bug indeed.  Let me think how to fix this most efficiently...
> >
> >
> >
> >>(This is in the code that has just been moved to tcp_ctlinput.)
> >>
> >>
> >>
> >>>Apparently the gateway should be suggesting a MTU value for use.... the
> >>>gateway is also FreeBSD 5.3 so something needs fixing .. :-/
> >>>
> >>>
> >>Are you using ip fast forwarding on the gateway? It calculates the
> >>size that is put into the ICMP message in a slightly different way
> >>to the other forwrd path.
> >>
> >>
> >
> >The quoted code above is used only for incoming ICMP packets.  It
> >does not generate them?  What is the problem being observed exactly?
> >
> >
> >
> As David suggested my config is shown here:
> 
> http://lists.freebsd.org/pipermail/freebsd-current/2005-April/048980.html
> 
> After talking with people I see 2 issues.....
> 
> 1/ The bug is being triggered when the incoming 'need frag' ICMP message
> doesn't have a suggested value.
> 
> This ICMP message is being generated by 'stealth.sorbs.net' which is a
> FreeBSD 5.3 p9 server running FAST_IPSEC (no crypto card yet - waiting
> for delivery), and otherwise pretty standard kernel. As for fast forwarding:
> 
> net.inet.ip.fastforwarding: 0
> 
> 2/ The bug itself is also a problem, as it cannot be guarenteed that the
> host returning the ICMP 'need frag' will fill in a suggested mtu, so
> that also needs to be looked at (but I guess you know that already ;-))

Ok, I'm looking into this stuff.

-- 
Andre