From patchwork Tue Jun 21 06:16:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 2520 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director13.mail.ord1d.rsapps.net ([172.27.255.52]) by backend41.mail.ord1d.rsapps.net with LMTP id yD51AUrvsWJvKAAAqwncew (envelope-from ) for ; Tue, 21 Jun 2022 12:18:18 -0400 Received: from proxy19.mail.iad3a.rsapps.net ([172.27.255.52]) by director13.mail.ord1d.rsapps.net with LMTP id iN5qAUrvsWLZEQAA91zNiA (envelope-from ) for ; Tue, 21 Jun 2022 12:18:18 -0400 Received: from smtp18.gate.iad3a ([172.27.255.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy19.mail.iad3a.rsapps.net with LMTPS id cOGyN0nvsWLbMgAAXy6Yeg (envelope-from ) for ; Tue, 21 Jun 2022 12:18:17 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp18.gate.iad3a.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: c1d5e908-f17d-11ec-9410-5254008b8116-1-1 Received: from [216.105.38.7] ([216.105.38.7:33396] helo=lists.sourceforge.net) by smtp18.gate.iad3a.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 77/50-20949-94FE1B26; Tue, 21 Jun 2022 12:18:17 -0400 Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.94.2) (envelope-from ) id 1o3gYt-0006QO-5p; Tue, 21 Jun 2022 16:17:06 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1o3gYr-0006QG-VM for openvpn-devel@lists.sourceforge.net; Tue, 21 Jun 2022 16:17:04 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=ti7skC1DzJTIcb35u1TqIxAwOzZa1uiR77qk3M0b2Gg=; b=V0N5jDjRoFhRGg2vHxlV04iVHJ jKiJTf/4/66vKrQghItZlT5jZalICiB9ktSSNYgjhGM8xxq71pOIvdmVCtN3vVIIg4FA62FE3QXZ0 9HbqIMme7p9o56Rh+kVri7cC/7EdtcygRX/prlNv9xbAiXpy90+rqaV54eZlhiirABtU=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=ti7skC1DzJTIcb35u1TqIxAwOzZa1uiR77qk3M0b2Gg=; b=j0zENZlfA15euCSzkbyZgue/Q6 GnIXxdQNrO1X9YKXOiMGTe9qdEErIEV7gxdFsqMgfOw7RozPKDpBslyR/ewtkHHom40LLcF77KAKJ IoUF04JURiHamiIKd8UgZOoWDmcSaSApvCJO/Ai3h4cTSrbI8+21lMZ1mokW3fOKSzV8=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.94.2) id 1o3gYo-0004fw-Nn for openvpn-devel@lists.sourceforge.net; Tue, 21 Jun 2022 16:17:04 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1o3gYc-000DmJ-5M for openvpn-devel@lists.sourceforge.net; Tue, 21 Jun 2022 18:16:50 +0200 Received: (nullmailer pid 2873042 invoked by uid 10006); Tue, 21 Jun 2022 16:16:50 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Tue, 21 Jun 2022 18:16:47 +0200 Message-Id: <20220621161649.2872985-4-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220621161649.2872985-1-arne@rfc2549.org> References: <20220621161649.2872985-1-arne@rfc2549.org> MIME-Version: 1.0 X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: We could also just hardcode this value to 1420 but this approach does not add much (complicated) code and it is a bit better than to have a magic number to just be there. Signed-off-by: Arne Schwabe --- src/openvpn/mtu.c | 22 ++++++++++++++++++++++ src/openvpn/mtu.h | 14 ++++++++++++++ tests/unit_tests/openvpn/test_crypto.c | 19 ++++++++++++++++++- 3 [...] Content analysis details: (0.2 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 T_SCC_BODY_TEXT_LINE No description available. X-Headers-End: 1o3gYo-0004fw-Nn Subject: [Openvpn-devel] [PATCH 4/6] Implement a function to calculate the default MTU X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox We could also just hardcode this value to 1420 but this approach does not add much (complicated) code and it is a bit better than to have a magic number to just be there. Signed-off-by: Arne Schwabe --- src/openvpn/mtu.c | 22 ++++++++++++++++++++++ src/openvpn/mtu.h | 14 ++++++++++++++ tests/unit_tests/openvpn/test_crypto.c | 19 ++++++++++++++++++- 3 files changed, 54 insertions(+), 1 deletion(-) diff --git a/src/openvpn/mtu.c b/src/openvpn/mtu.c index 59b917985..8afc16394 100644 --- a/src/openvpn/mtu.c +++ b/src/openvpn/mtu.c @@ -205,6 +205,28 @@ calc_options_string_link_mtu(const struct options *o, const struct frame *frame) return payload + overhead; } +int +frame_calculate_default_mtu(struct options *o) +{ + struct options options = *o; + + /* assume we have peer_id enabled */ + options.use_peer_id = true; + + /* We use IPv6+UDP here to have a consistent size for tun MTU no matter + * the combination of udp/tcp and IPv4/IPv6 */ + int encap_overhead = datagram_overhead(AF_INET6, PROTO_UDP); + + struct key_type kt; + init_key_type(&kt, "AES-256-GCM", "none", true, false); + + size_t payload_overhead = frame_calculate_payload_overhead(0, &options, &kt); + size_t protocol_overhead = frame_calculate_protocol_header_size(&kt, &options, false); + + return MTU_ENCAP_DEFAULT - encap_overhead - payload_overhead - protocol_overhead; + +} + void frame_print(const struct frame *frame, int level, diff --git a/src/openvpn/mtu.h b/src/openvpn/mtu.h index 9db6cf26a..d643027d3 100644 --- a/src/openvpn/mtu.h +++ b/src/openvpn/mtu.h @@ -79,6 +79,10 @@ */ #define MSSFIX_DEFAULT 1492 +/* The default size we aim to reach to with our VPN packets by setting + * the MTU accordingly */ +#define MTU_ENCAP_DEFAULT 1492 + /* * Alignment of payload data such as IP packet or * ethernet frame. @@ -260,6 +264,16 @@ void alloc_buf_sock_tun(struct buffer *buf, const struct frame *frame, const bool tuntap_buffer); + +/** + * Function to calculate the default MTU for Layer 3 VPNs. The function + * assumes that UDP packets should be a maximum of \c MTU_ENCAP_DEFAULT (1492) + * with a AEAD cipher. This default comes out to be 1420. + */ +int +frame_calculate_default_mtu(struct options *o); + + /* * EXTENDED_SOCKET_ERROR_CAPABILITY functions -- print extra error info * on socket errors, such as PMTU size. As of 2003.05.11, only works diff --git a/tests/unit_tests/openvpn/test_crypto.c b/tests/unit_tests/openvpn/test_crypto.c index 83572b827..ca595b0a5 100644 --- a/tests/unit_tests/openvpn/test_crypto.c +++ b/tests/unit_tests/openvpn/test_crypto.c @@ -477,6 +477,22 @@ test_mssfix_mtu_calculation(void **state) gc_free(&gc); } + +static void +test_mtu_default_calculation(void **state) +{ + struct options o = {0}; + + /* common defaults */ + o.ce.tun_mtu = 1400; + o.ce.mssfix = 1000; + o.replay = true; + o.ce.proto = PROTO_UDP; + + size_t mtu = frame_calculate_default_mtu(&o); + assert_int_equal(1420, mtu); +} + int main(void) { @@ -487,7 +503,8 @@ main(void) cmocka_unit_test(crypto_test_hmac), cmocka_unit_test(test_des_encrypt), cmocka_unit_test(test_occ_mtu_calculation), - cmocka_unit_test(test_mssfix_mtu_calculation) + cmocka_unit_test(test_mssfix_mtu_calculation), + cmocka_unit_test(test_mtu_default_calculation) }; #if defined(ENABLE_CRYPTO_OPENSSL)