Hello Florian, On Wed, Jan 06, 2021 at 00:15:23 +0100, Florian Westphal wrote: > Force refragmentation as per original sizes unconditionally so ip tunnel > will encapsulate the fragments instead. [...] > diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c > index 89fff5f59eea..2ed0b01f72f0 100644 > --- a/net/ipv4/ip_output.c > +++ b/net/ipv4/ip_output.c > @@ -302,7 +302,7 @@ static int __ip_finish_output(struct net *net, struct sock *sk, struct sk_buff * > if (skb_is_gso(skb)) > return ip_finish_output_gso(net, sk, skb, mtu); > > - if (skb->len > mtu || (IPCB(skb)->flags & IPSKB_FRAG_PMTU)) > + if (skb->len > mtu || IPCB(skb)->frag_max_size) > return ip_fragment(net, sk, skb, mtu, ip_finish_output2); > > return ip_finish_output2(net, sk, skb); > -- > 2.26.2 Did some tests yesterday and I can confirm that this patch fixes the problem for both IPIP tunnel and XFRM tunnel interfaces. Thanks for the fix! Christian Perle -- Christian Perle Senior Berater / Senior Consultant Netzwerk- und Client-Sicherheit / Network & Client Security Öffentliche Auftraggeber / Public Authorities secunet Security Networks AG Tel.: +49 201 54 54-3533, Fax: +49 201 54 54-1323 E-Mail: christian.perle@xxxxxxxxxxx Ammonstraße 74, 01067 Dresden, Deutschland www.secunet.com secunet Security Networks AG Sitz: Kurfürstenstraße 58, 45138 Essen, Deutschland Amtsgericht Essen HRB 13615 Vorstand: Axel Deininger (Vors.), Torsten Henn, Dr. Kai Martius, Thomas Pleines Aufsichtsratsvorsitzender: Ralf Wintergerst
