[PATCH ipsec] xfrm: check inner family via skb_dst for small_ipv6 DF clearing

[Sewook Seo <sewookseo@google.com>]

Commit 6821ad877034 ("xfrm: do not set IPv4 DF flag when encapsulating
IPv6 frames <= 1280 bytes.") intended to clear the outer IPv4 DF bit in
xfrm4_tunnel_encap_add() when encapsulating inner IPv6 frames of at most
IPV6_MIN_MTU (1280) bytes, by checking skb->protocol == htons(ETH_P_IPV6).

However, its caller xfrm4_prepare_output() overwrites skb->protocol with
htons(ETH_P_IP) before invoking xfrm4_tunnel_encap_add(), since
commit 0c620e97b349 ("xfrm: remove output indirection from xfrm_mode").
As a result, small_ipv6 always evaluates to false, leaving IP_DF set on
outer IPv4 tunnel packets even when encapsulating <= 1280-byte IPv6
frames.

This issue was observed on devices in production use over IPv6-in-IPv4
ESP-in-UDP tunnels where an intermediate IPv4 link has an MTU smaller
than the encapsulated packet size (e.g. < 1362 bytes) and ICMPv4
Fragmentation Needed errors are either filtered or not actionable below
IPV6_MIN_MTU, causing encapsulated <= 1280-byte IPv6 packets to be
dropped instead of fragmented by the outer IPv4 router.

At the time xfrm4_tunnel_encap_add() runs, skb_dst(skb) has not been
popped yet and still represents the inner packet destination entry, as
already used a few lines below to set top_iph->protocol via
xfrm_af2proto(skb_dst(skb)->ops->family), while skb->len still holds the
unencapsulated inner packet length. Check dst->ops->family == AF_INET6
instead of skb->protocol so small_ipv6 works as intended.

Tested on User-Mode Linux (ARCH=um) with a four-namespace IPv6-over-IPv4
XFRM ESP tunnel reproducer across a 1300-byte MTU router link with ICMPv4
Fragmentation Needed filtered (verifying 1280-byte inner IPv6 frames fail
before the fix and pass via outer IPv4 fragmentation with the fix, while
larger frames still preserve outer IP_DF), and verified all tests pass in
tools/testing/selftests/net/xfrm_state.sh.

Fixes: 6821ad877034 ("xfrm: do not set IPv4 DF flag when encapsulating IPv6 frames <= 1280 bytes.")
Cc: stable@vger.kernel.org
Cc: Maciej Żenczykowski <maze@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Assisted-by: LLM
Signed-off-by: Sewook Seo <sewookseo@google.com>
---
 net/xfrm/xfrm_output.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index f1f612cd7b43..60ffe9549c09 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -275,11 +275,14 @@ static int xfrm4_beet_encap_add(struct xfrm_state *x, struct sk_buff *skb)
  */
 static int xfrm4_tunnel_encap_add(struct xfrm_state *x, struct sk_buff *skb)
 {
-	bool small_ipv6 = (skb->protocol == htons(ETH_P_IPV6)) && (skb->len <= IPV6_MIN_MTU);
 	struct dst_entry *dst = skb_dst(skb);
 	struct iphdr *top_iph;
+	bool small_ipv6;
 	int flags;
 
+	small_ipv6 = (dst->ops->family == AF_INET6) &&
+		     (skb->len <= IPV6_MIN_MTU);
+
 	if (!skb->inner_protocol) {
 		skb_set_inner_network_header(skb, skb_network_offset(skb));
 		skb_set_inner_transport_header(skb, skb_transport_offset(skb));
-- 
2.56.0.542.g3ef89b7020-goog