Small ICMP fragments dropped by datapath

[joamaki]

While testing MTU settings with e.g. ping -s <large> I noticed that Cilium datapath currently seems to drop (tested rev 0ff85f2) ICMP fragments when the fragment is smaller than sizeof(icmphdr) due to the ICMP type check in __policy_can_access (https://github.com/cilium/cilium/blob/0ff85f2f9/bpf/lib/policy.h#L117) as the code is not checking whether the packet in question is a fragment and thus might not contain the ICMP header.

Would it be worth adding the extra branch to the datapath to fix this edge case?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

[kkourt]

Discussing this offline, it was determined that it's not worth addressing it (at least at this point), since this is a corner case and adding a branch in the datapath code will increase complexity. Hence, closing the issue. We can revisit if needed.