netdev - ppp_generic: fix multilink fragment MTU calculation (again)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 18 Sep 2011 19:41:49 -0400
From:	Henry Wong <v4l@...ffedcow.net>
To:	netdev@...r.kernel.org
Subject: ppp_generic: fix multilink fragment MTU calculation (again)

When using MLPPP, the maximum size of a fragment is incorrectly 
calculated with an offset of -2.
This patch reverses the changes in the patch found here: 
http://marc.info/?l=linux-netdev&m=123541324010539&w=2

The value of hdrlen includes the size of both the 2-byte PPP protocol 
field and the 2- or 4-byte multilink header (2+4=6 for long sequence 
numbers, 2+2=4 for short sequence numbers). Section 2 of RFC1661 says 
that the MRU that is negotiated (i.e., the MTU of the sending system) 
includes only the PPP payload but not the protocol field, thus the 
correct MTU should be the link's MTU minus the multilink header (mtu - 
(hdrlen-2)).

The incorrect calculation causes Linux to fragment packets to a size two 
bytes smaller than the allowed MTU. While not technically illegal, this 
behaviour confounds MRU-tuning to avoid PPP-layer fragmentation.

Signed-off-by: Henry Wong <henry@...ffedcow.net>

View attachment "mlppp-frag-mtu.patch" of type "text/x-patch" (647 bytes)