lwIP - A Lightweight TCP/IP stack - Bugs: bug #61946, IPv4 fragmentation fails for...
You are not allowed to post comments on this tracker with your current authentication level.
bug #61946: IPv4 fragmentation fails for certain MTU / packet length combinations
Submitter: | Carlos Sánchez de La Lama <csanchez> | ||
Submitted: | Thu 27 Jan 2022 06:26:07 PM UTC | ||
Category: | IPv4 | Severity: | 3 - Normal |
Item Group: | Faulty Behaviour | Status: | None |
Privacy: | Public | Assigned to: | None |
Open/Closed: | Open | Planned Release: | None |
lwIP version: | git head |
Attached Files
Depends on the following items: None found
Items that depend on this one: None found
Carbon-Copy List
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 5 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2022-01-27 | csanchez | Attached File | - | ![]() |
Added ip4_wrong_fragmentation_test.patch, #52756 |
Attached File | - | ![]() |
Added mtu300len1124.pcapng, #52757 | ||
Attached File | - | ![]() |
Added mtu304len1124.pcapng, #52758 | ||
Carbon-Copy | - | ![]() |
Added -email is unavailable- | ||
Carbon-Copy | - | ![]() |
Added -email is unavailable- |
The calculations used compute the size of the next fragment and to check whether current fragment is the last one differ. This causes that under certain size combinations, the one before last packet is (incorrectly) detected as last and therefore emitted without the "more fragments" flag.
This seems to have been introduced by commit 576f49ee2bad3839490e915c24ad1837d655637a
It happens when ((MTU-IPHDRLEN) % 8 != 0) and the packet length is such that last fragment would fit in (MTU-IPHDRLEN) but does not fit in (((MTU-IPHDRLEN)/8)*8), so two more fragments are generated.
Attached patch (ip4_wrong_fragmentation_test.patch) over master (34e435c78611fbf21c49c5ddb6c395a097e24cc7) adds code to ip4 fragmentation test which writes 4 .hex files to pwd.
mtu300len8000.hex -> bug does not trigger (29 fragments)
mtu300len1124.hex -> bug does not trigger (5 fragments)
mtu304len8000.hex -> bug does not trigger (29 fragments)
mtu304len1124.hex -> bug TRIGGERS (5 fragments but last is lost)
Those have hex dump format and can be imported into Wireshark for analysis. For convenience, I also attach .pcapng versions of mtu300len1124 and mtu304len1124, so the problem can be quickly observed.