[PATCH] improved MTU calculation for GlobalProtect ESP

[Daniel Lenski]

On Wed, Aug 16, 2017 at 8:07 PM, Daniel Lenski <dlenski at gmail.com> wrote:
> On Wed, Aug 16, 2017 at 8:03 PM, Daniel Lenski wrote:
> +/* Based on cstp.c's calculate_mtu().
> + *
> + * With HTTPS tunnel, there are 21 bytes of overhead beyond the
> + * TCP MSS: 5 bytes for TLS and 16 for GPST.
> + */
>  static int calculate_mtu(struct openconnect_info *vpninfo)
>  {

One thing that I've never understood about calculate_mtu(), but
retained anyway… :-D

It doesn't make any sense to mix-and-match the TLS overhead (start
with the TCP MSS, subtract 5 TLS bytes, subtract VPN-protocol-specific
header size) and the DTLS/ESP overhead (start with on-the-wire MTU,
subtract IP header, UDP header, and ESP headers and footers).

However, the cstp.c calculate_mtu() procedure definitely does
mix-and-match them, quite unpredictably.

For example, if the TCP_INFO sockopt returns a PMTU of 1500 bytes,
then that will be used as the base_mtu. But then the 13-byte overhead
for the TLS/HTTPS tunnel will be subtracted (???) and then the
overhead for the DTLS tunnel will be subtracted on top of that (???).

-Dan