tcpip: fix IP_MTU_DISCOVER flag for tcp and udp

Fixes #12319

This patch only supports various IP_MTU_DISCOVER flags.
To fully support `tracepath` actually tracing the path the correct propagation of TTL exceeded is needed.

FUTURE_COPYBARA_INTEGRATE_REVIEW=#12366 from pkit:pmtu_probe_support 5ca5162
PiperOrigin-RevId: 844591169

Author: pkit

pkg/tcpip/network/ipv4/ipv4.go

@@ -609,9 +609,7 @@ func (e *endpoint) writePacketPostRouting(r *stack.Route, pkt *stack.PacketBuffe
 
 	if packetMustBeFragmented(pkt, networkMTU) {
 		h := header.IPv4(pkt.NetworkHeader().Slice())
-		if h.Flags()&header.IPv4FlagDontFragment != 0 && pkt.NetworkPacketInfo.IsForwardedPacket {
-			// TODO(gvisor.dev/issue/5919): Handle error condition in which DontFragment
-			// is set but the packet must be fragmented for the non-forwarding case.
+		if h.Flags()&header.IPv4FlagDontFragment != 0 {
 			return &tcpip.ErrMessageTooLong{}
 		}
 		sent, remain, err := e.handleFragments(r, networkMTU, pkt, func(fragPkt *stack.PacketBuffer) tcpip.Error {

pkg/tcpip/transport/internal/network/endpoint.go

@@ -74,6 +74,8 @@ type Endpoint struct {
 	ipv4TOS uint8
 	// +checklocks:mu
 	ipv6TClass uint8
+	// +checklocks:mu
+	pmtudStrategy tcpip.PMTUDStrategy
 
 	// Lock ordering: mu > infoMu.
 	infoMu sync.RWMutex `state:"nosave"`
@@ -358,10 +360,15 @@ func (c *WriteContext) WritePacket(pkt *stack.PacketBuffer, headerIncluded bool)
 		expOptVal = c.e.ops.GetExperimentOptionValue()
 	}
 
+	c.e.mu.RLock()
+	pmtud := c.e.pmtudStrategy
+	c.e.mu.RUnlock()
+
 	err := c.route.WritePacket(stack.NetworkHeaderParams{
 		Protocol:              c.e.transProto,
 		TTL:                   c.ttl,
 		TOS:                   c.tos,
+		DF:                    pmtud == tcpip.PMTUDiscoveryWant || pmtud == tcpip.PMTUDiscoveryDo || pmtud == tcpip.PMTUDiscoveryProbe,
 		ExperimentOptionValue: expOptVal,
 	}, pkt)
 
@@ -840,9 +847,13 @@ func (e *Endpoint) GetRemoteAddress() (tcpip.FullAddress, bool) {
 func (e *Endpoint) SetSockOptInt(opt tcpip.SockOptInt, v int) tcpip.Error {
 	switch opt {
 	case tcpip.MTUDiscoverOption:
-		// Return not supported if the value is not disabling path
-		// MTU discovery.
-		if tcpip.PMTUDStrategy(v) != tcpip.PMTUDiscoveryDont {
+		strategy := tcpip.PMTUDStrategy(v)
+		switch strategy {
+		case tcpip.PMTUDiscoveryWant, tcpip.PMTUDiscoveryDont, tcpip.PMTUDiscoveryDo, tcpip.PMTUDiscoveryProbe:
+			e.mu.Lock()
+			e.pmtudStrategy = strategy
+			e.mu.Unlock()
+		default:
 			return &tcpip.ErrNotSupported{}
 		}
 
@@ -891,8 +902,10 @@ func (e *Endpoint) SetSockOptInt(opt tcpip.SockOptInt, v int) tcpip.Error {
 func (e *Endpoint) GetSockOptInt(opt tcpip.SockOptInt) (int, tcpip.Error) {
 	switch opt {
 	case tcpip.MTUDiscoverOption:
-		// The only supported setting is path MTU discovery disabled.
-		return int(tcpip.PMTUDiscoveryDont), nil
+		e.mu.Lock()
+		v := int(e.pmtudStrategy)
+		e.mu.Unlock()
+		return v, nil
 
 	case tcpip.MulticastTTLOption:
 		e.mu.Lock()

pkg/tcpip/transport/tcp/connect.go

@@ -1042,7 +1042,7 @@ func (e *Endpoint) sendRaw(pkt *stack.PacketBuffer, flags header.TCPFlags, seq,
 		ack:       ack,
 		rcvWnd:    rcvWnd,
 		opts:      options,
-		df:        e.pmtud == tcpip.PMTUDiscoveryWant || e.pmtud == tcpip.PMTUDiscoveryDo,
+		df:        e.pmtud == tcpip.PMTUDiscoveryWant || e.pmtud == tcpip.PMTUDiscoveryDo || e.pmtud == tcpip.PMTUDiscoveryProbe,
 		expOptVal: expOptVal,
 	}, pkt, e.gso)
 }

pkg/tcpip/transport/tcp/endpoint.go

@@ -1895,18 +1895,9 @@ func (e *Endpoint) SetSockOptInt(opt tcpip.SockOptInt, v int) tcpip.Error {
 		e.UnlockUser()
 
 	case tcpip.MTUDiscoverOption:
-		switch v := tcpip.PMTUDStrategy(v); v {
-		case tcpip.PMTUDiscoveryWant, tcpip.PMTUDiscoveryDont, tcpip.PMTUDiscoveryDo:
-			e.LockUser()
-			e.pmtud = v
-			e.UnlockUser()
-		case tcpip.PMTUDiscoveryProbe:
-			// We don't support a way to ignore MTU updates; it's
-			// either on or it's off.
-			return &tcpip.ErrNotSupported{}
-		default:
-			return &tcpip.ErrNotSupported{}
-		}
+		e.LockUser()
+		e.pmtud = tcpip.PMTUDStrategy(v)
+		e.UnlockUser()
 
 	case tcpip.IPv4TTLOption:
 		e.LockUser()
@@ -2965,7 +2956,14 @@ func (e *Endpoint) HandleError(transErr stack.TransportError, pkt *stack.PacketB
 	// TODO(gvisor.dev/issues/5270): Handle all transport errors.
 	switch transErr.Kind() {
 	case stack.PacketTooBigTransportError:
-		handlePacketTooBig(transErr.Info())
+		e.mu.Lock()
+		pmtud := e.pmtud
+		e.mu.Unlock()
+		if pmtud == tcpip.PMTUDiscoveryProbe {
+			e.onICMPError(&tcpip.ErrMessageTooLong{}, transErr, pkt)
+		} else {
+			handlePacketTooBig(transErr.Info())
+		}
 	case stack.DestinationHostUnreachableTransportError:
 		e.onICMPError(&tcpip.ErrHostUnreachable{}, transErr, pkt)
 	case stack.DestinationNetworkUnreachableTransportError:

pkg/tcpip/transport/udp/endpoint.go

@@ -520,6 +520,21 @@ func (e *endpoint) write(p tcpip.Payloader, opts tcpip.WriteOptions) (int64, tcp
 	}
 	if err := udpInfo.ctx.WritePacket(pkt, false /* headerIncluded */); err != nil {
 		e.stack.Stats().UDP.PacketSendErrors.Increment()
+		if _, ok := err.(*tcpip.ErrMessageTooLong); ok {
+			so := e.SocketOptions()
+			if so.GetIPv4RecvError() || so.GetIPv6RecvError() {
+				so.QueueLocalErr(
+					err,
+					udpInfo.ctx.PacketInfo().NetProto,
+					udpInfo.ctx.MTU(),
+					tcpip.FullAddress{
+						Addr: udpInfo.ctx.PacketInfo().RemoteAddress,
+						Port: udpInfo.remotePort,
+					},
+					nil,
+				)
+			}
+		}
 		return 0, err
 	}
 
@@ -1050,6 +1065,8 @@ func (e *endpoint) HandleError(transErr stack.TransportError, pkt *stack.PacketB
 		if e.net.State() == transport.DatagramEndpointStateConnected {
 			e.onICMPError(&tcpip.ErrConnectionRefused{}, transErr, pkt)
 		}
+	case stack.PacketTooBigTransportError:
+		e.onICMPError(&tcpip.ErrMessageTooLong{}, transErr, pkt)
 	}
 }
 

test/syscalls/linux/tcp_socket.cc

@@ -2357,21 +2357,14 @@ TEST_P(TcpSocketTest, SetPMTUD) {
       SyscallSucceeds());
   EXPECT_EQ(got, IP_PMTUDISC_DONT);
 
-  // IP_PMTUDISC_PROBE is not supported by gVisor.
   set = IP_PMTUDISC_PROBE;
-  if (IsRunningOnGvisor() && !IsRunningWithHostinet()) {
-    ASSERT_THAT(
-        setsockopt(accepted_.get(), SOL_IP, IP_MTU_DISCOVER, &set, length),
-        SyscallFailsWithErrno(ENOTSUP));
-  } else {
-    ASSERT_THAT(
-        setsockopt(accepted_.get(), SOL_IP, IP_MTU_DISCOVER, &set, length),
-        SyscallSucceeds());
-    ASSERT_THAT(
-        getsockopt(accepted_.get(), SOL_IP, IP_MTU_DISCOVER, &got, &length),
-        SyscallSucceeds());
-    EXPECT_EQ(got, IP_PMTUDISC_PROBE);
-  }
+  ASSERT_THAT(
+      setsockopt(accepted_.get(), SOL_IP, IP_MTU_DISCOVER, &set, length),
+      SyscallSucceeds());
+  ASSERT_THAT(
+      getsockopt(accepted_.get(), SOL_IP, IP_MTU_DISCOVER, &got, &length),
+      SyscallSucceeds());
+  EXPECT_EQ(got, IP_PMTUDISC_PROBE);
 }
 
 TEST_P(SimpleTcpSocketTest, GetSocketAcceptConnWithShutdown) {