1 files changed, 65 insertions, 9 deletions

diff --git a/src/ipcpd/udp/udp.c b/src/ipcpd/udp/udp.c
index 452bbc1a..93e88b9b 100644
--- a/src/ipcpd/udp/udp.c
+++ b/src/ipcpd/udp/udp.c
@@ -47,6 +47,10 @@
 #include <stdlib.h>
 #include <sys/wait.h>
 #include <fcntl.h>
+#include <unistd.h>
+#if defined(__linux__)
+#include <netinet/ip.h>
+#endif
 
 #define FLOW_REQ                 1
 #define FLOW_REPLY               2
@@ -87,7 +91,7 @@ struct mgmt_msg {
         uint8_t  code;
         /* QoS parameters from spec */
         uint8_t  availability;
-        uint8_t  in_order;
+        uint8_t  service;
 } __attribute__((packed));
 
 struct mgmt_frame {
@@ -130,6 +134,53 @@ static const char * __inet_ntop(const struct __ADDR * addr,
         return inet_ntop(__AF, addr, buf, __ADDRSTRLEN);
 }
 
+#if defined(BUILD_IPCP_UDP4)
+#define UDP_MTU_FALLBACK IPCP_UDP4_MTU
+#define UDP_IP_OVERHEAD  28U /* IPv4 + UDP */
+#else
+#define UDP_MTU_FALLBACK IPCP_UDP6_MTU
+#define UDP_IP_OVERHEAD  48U /* IPv6 + UDP */
+#endif
+
+static uint32_t udp_query_mtu(const struct __SOCKADDR * saddr)
+{
+#if defined(__linux__) && (defined(IP_MTU) || defined(IPV6_MTU))
+        int       sock;
+        int       mtu = 0;
+        socklen_t len = sizeof(mtu);
+
+        sock = socket(__AF, SOCK_DGRAM, IPPROTO_UDP);
+        if (sock < 0)
+                return UDP_MTU_FALLBACK;
+
+        if (connect(sock, (const struct sockaddr *) saddr,
+                    sizeof(*saddr)) < 0)
+                goto fallback;
+
+#if defined(BUILD_IPCP_UDP4) && defined(IP_MTU)
+        if (getsockopt(sock, IPPROTO_IP, IP_MTU, &mtu, &len) < 0)
+                goto fallback;
+#elif defined(BUILD_IPCP_UDP6) && defined(IPV6_MTU)
+        if (getsockopt(sock, IPPROTO_IPV6, IPV6_MTU, &mtu, &len) < 0)
+                goto fallback;
+#else
+        goto fallback;
+#endif
+        close(sock);
+
+        if (mtu <= (int) UDP_IP_OVERHEAD)
+                return UDP_MTU_FALLBACK;
+
+        return (uint32_t) mtu - UDP_IP_OVERHEAD;
+
+ fallback:
+        close(sock);
+#else
+        (void) saddr;
+#endif
+        return UDP_MTU_FALLBACK;
+}
+
 static int udp_data_init(void)
 {
         int                i;
@@ -220,7 +271,7 @@ static int udp_ipcp_port_alloc(const struct __SOCKADDR * r_saddr,
         msg->availability = qs.availability;
         msg->loss         = hton32(qs.loss);
         msg->ber          = hton32(qs.ber);
-        msg->in_order     = qs.in_order;
+        msg->service      = qs.service;
         msg->max_gap      = hton32(qs.max_gap);
         msg->timeout      = hton32(qs.timeout);
 
@@ -285,7 +336,8 @@ static int udp_ipcp_port_req(struct __SOCKADDR * c_saddr,
 {
         int fd;
 
-        fd = ipcp_wait_flow_req_arr(dst, qs, IPCP_UDP_MPL, data);
+        fd = ipcp_wait_flow_req_arr(dst, qs, IPCP_UDP_MPL,
+                                    udp_query_mtu(c_saddr), data);
         if (fd < 0) {
                 log_err("Could not get new flow from IRMd.");
                 return -1;
@@ -332,7 +384,8 @@ static int udp_ipcp_port_alloc_reply(const struct __SOCKADDR * saddr,
 
         pthread_rwlock_unlock(&udp_data.flows_lock);
 
-        if (ipcp_flow_alloc_reply(s_eid, response, mpl, data) < 0) {
+        if (ipcp_flow_alloc_reply(s_eid, response, mpl,
+                                  udp_query_mtu(saddr), data) < 0) {
                 log_err("Failed to reply to flow allocation.");
                 return -1;
         }
@@ -352,13 +405,18 @@ static int udp_ipcp_mgmt_frame(struct __SOCKADDR c_saddr,
         qosspec_t         qs;
         buffer_t          data;
 
+        /* Defence against malformed/corrupted wire input. */
+        if (len < sizeof(*msg))
+                return -1;
+
         msg = (struct mgmt_msg *) buf;
 
         switch (msg->code) {
         case FLOW_REQ:
                 msg_len = sizeof(*msg) + ipcp_dir_hash_len();
 
-                assert(len >= msg_len);
+                if (len < msg_len)
+                        return -1;
 
                 data.len  = len - msg_len;
                 data.data = (uint8_t *) buf + msg_len;
@@ -369,7 +427,7 @@ static int udp_ipcp_mgmt_frame(struct __SOCKADDR c_saddr,
                 qs.availability = msg->availability;
                 qs.loss         = ntoh32(msg->loss);
                 qs.ber          = ntoh32(msg->ber);
-                qs.in_order     = msg->in_order;
+                qs.service      = msg->service;
                 qs.max_gap      = ntoh32(msg->max_gap);
                 qs.timeout      = ntoh32(msg->timeout);
 
@@ -377,8 +435,6 @@ static int udp_ipcp_mgmt_frame(struct __SOCKADDR c_saddr,
                                          (uint8_t *) (msg + 1), qs,
                                           &data);
         case FLOW_REPLY:
-                assert(len >= sizeof(*msg));
-
                 data.len  = len - sizeof(*msg);
                 data.data = (uint8_t *) buf + sizeof(*msg);
 
@@ -549,7 +605,7 @@ static void * udp_ipcp_packet_writer(void * o)
                                 continue;
                         }
 
-                        buf = ssm_pk_buff_head_alloc(spb, OUR_HEADER_LEN);
+                        buf = ssm_pk_buff_push(spb, OUR_HEADER_LEN);
                         if (buf == NULL) {
                                 log_dbg("Failed to allocate header.");
                                 ipcp_spb_release(spb);