mirror of https://github.com/jmcorgan/fips.git synced 2026-07-30 19:46:15 +00:00

T

Origami74andJohnathan Corgan 852f561fa0 feat: implement ICMP Packet Too Big and TCP MSS clamping for MTU handling

Add dual-approach MTU handling to prevent TCP connections from hanging
when packets exceed the transport MTU after FIPS encapsulation.

ICMPv6 Packet Too Big:
- Generate RFC 4443 PTB messages for oversized packets at TUN outbound
- Inject back via TUN for local delivery to the application
- Per-source rate limiting (100ms interval, 10s entry expiry)
- MTU check in handle_tun_outbound before session encapsulation

TCP MSS Clamping:
- Intercept SYN packets in run_tun_reader() (outbound)
- Intercept SYN-ACK packets in TunWriter (inbound)
- Clamp MSS option to fit within effective MTU (transport - 127 overhead)
- Recalculate TCP checksum after modification

Code organization:
- ICMP, TCP MSS, and rate limiter modules in upper/ alongside existing
  protocol-specific packet handling (dns.rs, tun.rs)
- Shared FIPS_OVERHEAD constant (127 bytes) and effective_ipv6_mtu()
  function in upper/icmp.rs
- Node::effective_ipv6_mtu() delegates to the shared function
- run_tun_reader() accepts actual transport MTU from config

Example config corrections:
- UDP transport MTU set to 1472 across all configs (correct max UDP
  payload for standard Ethernet: 1500 - 20 IPv4 - 8 UDP)
- Startup logging of effective MTU and max MSS values

2026-02-16 21:33:21 +00:00

benches

Bloom module test coverage, benchmarks, and design doc corrections

2026-02-15 16:05:59 +00:00

docs

feat: implement ICMP Packet Too Big and TCP MSS clamping for MTU handling

2026-02-16 21:33:21 +00:00

examples/docker-network

feat: implement ICMP Packet Too Big and TCP MSS clamping for MTU handling

2026-02-16 21:33:21 +00:00

src

feat: implement ICMP Packet Too Big and TCP MSS clamping for MTU handling