[lwip-devel] [bug #61946] IPv4 fragmentation fails for certain MTU / packet length combinations

[Carlos Sánchez de La Lama]

URL:
  <https://savannah.nongnu.org/bugs/?61946>

                 Summary: IPv4 fragmentation fails for certain MTU / packet
length combinations
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: csanchez
            Submitted on: Thu 27 Jan 2022 06:26:07 PM UTC
                Category: IPv4
                Severity: 3 - Normal
              Item Group: Faulty Behaviour
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None
            lwIP version: git head

    _______________________________________________________

Details:

The calculations used compute the size of the next fragment and to check
whether current fragment is the last one differ. This causes that under
certain size combinations, the one before last packet is (incorrectly)
detected as last and therefore emitted without the "more fragments" flag.

This seems to have been introduced by commit
576f49ee2bad3839490e915c24ad1837d655637a

It happens when ((MTU-IPHDRLEN) % 8 != 0) and the packet length is such that
last fragment would fit in (MTU-IPHDRLEN) but does not fit in
(((MTU-IPHDRLEN)/8)*8), so two more fragments are generated.

Attached patch (ip4_wrong_fragmentation_test.patch) over master
(34e435c78611fbf21c49c5ddb6c395a097e24cc7) adds code to ip4 fragmentation test
which writes 4 .hex files to pwd.

mtu300len8000.hex -> bug does not trigger (29 fragments)
mtu300len1124.hex -> bug does not trigger (5 fragments)
mtu304len8000.hex -> bug does not trigger (29 fragments)
mtu304len1124.hex -> bug TRIGGERS (5 fragments but last is lost)

Those have hex dump format and can be imported into Wireshark for analysis.
For convenience, I also attach .pcapng versions of mtu300len1124 and
mtu304len1124, so the problem can be quickly observed.  




    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Thu 27 Jan 2022 06:26:07 PM UTC  Name:
ip4_wrong_fragmentation_test.patch  Size: 4KiB   By: csanchez

<http://savannah.nongnu.org/bugs/download.php?file_id=52756>
-------------------------------------------------------
Date: Thu 27 Jan 2022 06:26:07 PM UTC  Name: mtu300len1124.pcapng  Size: 2KiB 
 By: csanchez

<http://savannah.nongnu.org/bugs/download.php?file_id=52757>
-------------------------------------------------------
Date: Thu 27 Jan 2022 06:26:07 PM UTC  Name: mtu304len1124.pcapng  Size: 2KiB 
 By: csanchez

<http://savannah.nongnu.org/bugs/download.php?file_id=52758>

    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/bugs/?61946>

_______________________________________________
  Message sent via Savannah
  https://savannah.nongnu.org/