Re: UDP bugs

Alexey Kuznetsov (kuznet@ms2.inr.ac.ru)
Sun, 13 Dec 1998 21:02:33 +0300 (MSK)


Hello!

> If the limit of 65507 Richard quoted is right then there is a off-by-one
> bug somewhere - the limit should be 65508 for UDP (65536 - 20 bytes ip header
> - 8 bytes UDP header) and 65516 for RAW sockets (and 65536 when IP_HDRINCL
> is set). If the input limit is smaller this is a bug too.
>
> Right, my current theory is that we get into trouble somewhere where
> we align some header object and add the alignment residue into the
> total length, get confused, and toss the packet because we think it is
> too big. Or it's a simple ">=" vs. ">" test off by one bug.

Maximal size of valid IP frame is 65535 rather than 65536,
hence maximal possible udp payload is 65507 and we are right.

BTW when packet is fragmented we COULD extend frame size
to maximal fragment offset (0xFFF8) plus mtu without breaking
IP integrity, but we are not allowed to make this dirty trick.
Apparently, Solaris does, but I do not think that it was
delibirate decision 8)8)8)

Alexey

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/