Re: [PATCH] netfilter: TCPMSS: fix dropped packets when MSS option is unaligned
From: Fernando Fernandez Mancera <hidden>
Date: 2026-05-25 22:08:18
Also in:
lkml, netfilter-devel, stable
From: Fernando Fernandez Mancera <hidden>
Date: 2026-05-25 22:08:18
Also in:
lkml, netfilter-devel, stable
On 5/25/26 11:28 PM, Florian Westphal wrote:
Kacper Kokot [off-list ref] wrote:quoted
Padding TCP options with NOPs is optional, so it is legal to send an MSS option that is not aligned to a word boundary and therefore not aligned for checksum calculation. The current TCPMSS target is not robust to this: when the MSS option is unaligned it produces an invalid checksum, and the packet is dropped.Is this an actual, real world bug? This code is 20+ years old, all that this hints at is that they are always aligned in reality?
AFAICS, these issues are not present in real environments as MSS option is placed at the beginning of the options block making it aligned by default usually. I would say this is more for correctness. I wonder, if we are touching this code, we could use the opportunity to make it use get_unaligned_be16() instead.