Disable PMTU discovery for RADIUS packets (sent them without DF)

When Linux has Path MTU discovery enabled, it sets by default the DF bit
on all outgoing datagrams, also UDP ones. If a RADIUS message is bigger
than the smallest MTU size to the target, it will be discarded.

This effectively limits RADIUS messages to ~ 1500 Bytes, while they can
be up to 4k according to RFC2865. In practice, this can mean trouble
when doing EAP-TLS with many RADIUS attributes besides the EAP-Message.
[Bug 326]

diff --git a/src/radius/radius_server.c b/src/radius/radius_server.c
index 1bfb93c70bccb0ff49d87ae95165aff1338d2be0..f691752407cc4e637f781f06008574afa7b48539 100644 (file)
--- a/src/radius/radius_server.c
+++ b/src/radius/radius_server.c
@@ -765,6 +765,22 @@ fail:
 }
 
 
+static int radius_server_disable_pmtu_discovery(int s)
+{
+       int r = -1;
+#if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
+       /* Turn off Path MTU discovery on IPv4/UDP sockets. */
+       int action = IP_PMTUDISC_DONT;
+       r = setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER, &action,
+                      sizeof(action));
+       if (r == -1)
+               wpa_printf(MSG_ERROR, "Failed to set IP_MTU_DISCOVER: "
+                          "%s", strerror(errno));
+#endif
+       return r;
+}
+
+
 static int radius_server_open_socket(int port)
 {
        int s;
@@ -776,6 +792,8 @@ static int radius_server_open_socket(int port)
                return -1;
        }
 
+       radius_server_disable_pmtu_discovery(s);
+
        os_memset(&addr, 0, sizeof(addr));
        addr.sin_family = AF_INET;
        addr.sin_port = htons(port);