TLS doesn't work on PPPoE in Chelan: MTU issue
2010-07-29 13:47
501 查看
I fixed a MTU bug this week. The bug description was very interesting and confusing.
1) PPPoE works well, if other than TLS authentication method was selected;
2) PPTP works well if only EAP-TLS is selected for authentication method;
3) PPPoE connection failed, if only EAP-TLS is selected for authentication method;
PPPoE is ok according to 1), TLS is ok according to 2). So, the 3) failure should be cause by some special feature, which is different between PPPOE and PPTP. First, I checked on which step the pppoe connection failed.
As you can see in the picture, a lot of repeating EAP request packets were sent out from the PPPOE server. No Response packets were sent out since frame 282. So something must be wrong with TLS authentication. I found the expected packet contain certificates of client. The failure happened in PPPoE, not TLS.
At last, I found the size of the expected packet is 1502, two bytes larger than ethernet's MTU. So, it might be a MTU issue. After further investigation, the root cause of this bug was found:
1) MTU - Maximum Transmissible Unit, it means the maximum size of packet that will be send on a special network;
2) MTU for Ethernet is 1500 bytes;
3) PPP and PPPoE header contains another 8 bytes based on ethernet frame, so the MTU for PPPoE is 1492 bytes;
4) TLS send certificate using MTU of 1500, which increased to 1508 after being encapsulted by PPPoE.
6) Certificate packets were dropped by NDIS because it could not be sent out on ethernet.
The bug was fixed by changing the MTU of TLS from 1500 to 1492.
By the way, in all the network modules, only IP and TLS include support for fragmentation and reassembly.
1) PPPoE works well, if other than TLS authentication method was selected;
2) PPTP works well if only EAP-TLS is selected for authentication method;
3) PPPoE connection failed, if only EAP-TLS is selected for authentication method;
PPPoE is ok according to 1), TLS is ok according to 2). So, the 3) failure should be cause by some special feature, which is different between PPPOE and PPTP. First, I checked on which step the pppoe connection failed.
As you can see in the picture, a lot of repeating EAP request packets were sent out from the PPPOE server. No Response packets were sent out since frame 282. So something must be wrong with TLS authentication. I found the expected packet contain certificates of client. The failure happened in PPPoE, not TLS.
At last, I found the size of the expected packet is 1502, two bytes larger than ethernet's MTU. So, it might be a MTU issue. After further investigation, the root cause of this bug was found:
1) MTU - Maximum Transmissible Unit, it means the maximum size of packet that will be send on a special network;
2) MTU for Ethernet is 1500 bytes;
3) PPP and PPPoE header contains another 8 bytes based on ethernet frame, so the MTU for PPPoE is 1492 bytes;
4) TLS send certificate using MTU of 1500, which increased to 1508 after being encapsulted by PPPoE.
6) Certificate packets were dropped by NDIS because it could not be sent out on ethernet.
Portion | Bytes |
Payload | 1492 |
PPP Headers | +2 |
PPPoE Headers | +6 |
Ethernet Headers | +18 |
Total Frame Size | 1518 |
By the way, in all the network modules, only IP and TLS include support for fragmentation and reassembly.
相关文章推荐
- setComponentEnabledSetting doesn't work on widget 以及副作用
- topmargin=\"0\" doesn\'t work in Firefox?
- adb logcat filter doesn't work
- 安装rhel5.4遇到的IO-APIC+timer doesn't work .
- My Backspace Key doesn't work!
- mysql check constraint doesn't work
- set_terminate doesn't work
- My Backspace Key doesn't work!
- 'Icon already includes gloss effects' doesn't work on iOS 6 compiled on xCode 5 with SDK 7
- Attempting to start Apache service...but apache doesn't work
- ActionBarSherlock: changing homeAsUpIndicator doesn't work
- 貌似csdn文章搜索doesn't work
- window.close() doesn't work - Scripts may not close windows that were not opened by script.
- ViewPager.setOffscreenPageLimit(0) doesn't work as expected
- Xcode code sense and cmd+click to symbol doesn't work for 1 of my projects
- eclipse插件Maven添加依赖查询无结果的解决方法(Select Dependency doesn't work)
- BitmapImage.UriSource binding doesn't work ...
- When Element add attribute by the method "setAttribute",It can't work in IE
- Why dynamic_cast doesn't work ?
- File@CompanionFile doesn't work