netdev - [PATCH net-next] net: pppoe: use correct MTU when using Multilink PPP with PPPoE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <53BF8DC1.1040905@kristov.de>
Date:	Fri, 11 Jul 2014 09:09:53 +0200
From:	Christoph Schulz <develop@...stov.de>
To:	netdev@...r.kernel.org
CC:	linux-ppp@...r.kernel.org, mostrows@...il.com
Subject: [PATCH net-next] net: pppoe: use correct MTU when using Multilink
 PPP with PPPoE

From: Christoph Schulz <develop@...stov.de>

The PPP channel MTU is used with Multilink PPP when ppp_mp_explode() (see
ppp_generic module) tries to determine how big a fragment might be. If we
don't subtract 2 bytes (which corresponds to the PPP protocol number), the
payload becomes 1-2 bytes too big (1 byte if PPP protocol compression is
used, 2 otherwise), which causes the generated Ethernet packets to be dropped.
This is due to code in ppp_mp_explode() which says:

		/*
		 * hdrlen includes the 2-byte PPP protocol field, but the
		 * MTU counts only the payload excluding the protocol field.
		 * (RFC1661 Section 2)
		 */
		mtu = pch->chan->mtu - (hdrlen - 2);

This is correct, but the pppoe module does not account for it and includes
the 2-byte PPP protocol field into the computed MTU, which is wrong. This
error only manifests itself when using Multilink PPP, as otherwise the channel
MTU is not used anywhere.

The bug was introduced in commit c9aa6895371b2a257401f59d3393c9f7ac5a8698
("[PPPOE]: Advertise PPPoE MTU") from the very beginning. This patch applies
to 3.10 upwards but the fix can be applied (with minor modifications) to
kernels as old as 2.6.32.

Signed-off-by: Christoph Schulz <develop@...stov.de>
---
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 2ea7efd..6c9c16d 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -675,7 +675,7 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
 		po->chan.hdrlen = (sizeof(struct pppoe_hdr) +
 				   dev->hard_header_len);

-		po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr);
+		po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2;
 		po->chan.private = sk;
 		po->chan.ops = &pppoe_chan_ops;

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html