From 52ce4df18e84dc9a6d1c80a084870630be22afe7 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 25 Jan 2016 10:53:10 +0000 Subject: [PATCH 1/2] Increase the lowest possible good PMTU The current minimum PMTU we can detect is eight bytes, which, being lower than the minimum IPv4 MTU of 68 bytes, can cause an exception in the sleeve packet fragmentation implementation. We increase that minimum to 552, the lowest PMTU value that Linux will cache. --- router/sleeve.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/router/sleeve.go b/router/sleeve.go index 0be92572..1b4e2078 100644 --- a/router/sleeve.go +++ b/router/sleeve.go @@ -917,7 +917,7 @@ func (fwd *sleeveForwarder) processSendError(err error) error { return nil } - fwd.mtuHighestGood = 8 + fwd.mtuHighestGood = 552 fwd.mtuLowestBad = mtu + 1 fwd.mtuCandidate = mtu fwd.mtuTestsSent = 0 From de17a44f3588d34b6dfd76a6369c73dc8995db10 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 25 Jan 2016 10:58:31 +0000 Subject: [PATCH 2/2] Fix fragmentation test The assumptions on which this test was based were violated by the introduction of fast datapath. A new rule is required to block fast datapath traffic, to ensure that sleeve is selected for forwarding; the rules must also be moved from the FORWARD chain to INPUT as the router now runs in the host netns (NB we use INPUT instead of OUTPUT as the latter results in sleeve receiving an 'operation not permitted' udpv4 write error when it tries to send a packet that is too big, rather than the packet just being silently dropped as required) --- test/105_frag_2_test.sh | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/test/105_frag_2_test.sh b/test/105_frag_2_test.sh index bb898b28..3c42ba98 100755 --- a/test/105_frag_2_test.sh +++ b/test/105_frag_2_test.sh @@ -8,7 +8,8 @@ C2=10.2.1.71 # 700 = Linux's minimum PMTU (552) + weave framing overheads # (currently about 60, but we leave some margin). That way the PMTUs # seen by containers is still >= 552. -drop_large_udp_packets="FORWARD -p udp --destination-port 6783 -m length '!' --length 0:700 -j DROP" +drop_large_sleeve_packets="INPUT -p udp --destination-port 6783 -m length '!' --length 0:700 -j DROP" +drop_large_fastdp_packets="INPUT -p udp --destination-port 6784 -m length '!' --length 0:700 -j DROP" start_suite "PMTU discovery and packet fragmentation" @@ -18,7 +19,8 @@ weave_on $HOST2 launch start_container $HOST1 $C1/24 --name=c1 start_container $HOST2 $C2/24 --name=c2 -run_on $HOST2 "sudo iptables -I $drop_large_udp_packets" +run_on $HOST1 "sudo iptables -I $drop_large_sleeve_packets" +run_on $HOST1 "sudo iptables -I $drop_large_fastdp_packets" assert_raises "weave_on $HOST2 connect $HOST1" sleep 35 # give weave time to discover the PMTU @@ -28,6 +30,7 @@ sleep 35 # give weave time to discover the PMTU exec_on $HOST2 c2 $PING -s 10000 $C1 1>/dev/null 2>&1 || true assert_raises "exec_on $HOST2 c2 $PING -s 10000 $C1" -run_on $HOST2 "sudo iptables -D $drop_large_udp_packets" +run_on $HOST1 "sudo iptables -D $drop_large_fastdp_packets" +run_on $HOST1 "sudo iptables -D $drop_large_sleeve_packets" end_suite