On Wed, Aug 16, 2017 at 8:07 PM, Daniel Lenski <dlenski at gmail.com> wrote:
> On Wed, Aug 16, 2017 at 8:03 PM, Daniel Lenski wrote:
> +/* Based on cstp.c's calculate_mtu().
> + *
> + * With HTTPS tunnel, there are 21 bytes of overhead beyond the
> + * TCP MSS: 5 bytes for TLS and 16 for GPST.
> + */
> static int calculate_mtu(struct openconnect_info *vpninfo)
> {
One thing that I've never understood about calculate_mtu(), but
retained anyway? :-D
It doesn't make any sense to mix-and-match the TLS overhead (start
with the TCP MSS, subtract 5 TLS bytes, subtract VPN-protocol-specific
header size) and the DTLS/ESP overhead (start with on-the-wire MTU,
subtract IP header, UDP header, and ESP headers and footers).
However, the cstp.c calculate_mtu() procedure definitely does
mix-and-match them, quite unpredictably.
For example, if the TCP_INFO sockopt returns a PMTU of 1500 bytes,
then that will be used as the base_mtu. But then the 13-byte overhead
for the TLS/HTTPS tunnel will be subtracted (???) and then the
overhead for the DTLS tunnel will be subtracted on top of that (???).
-Dan
