When processing ICMP need frag message, ignore the suggested MTU unless it

is smaller than the current one for this connection. This is behavior
specified by RFC 1191, and this is how original BSD stack behaved, but this
was unintentionally regressed in r182851.

Reported & tested by:	Richard Russo <russor whatsapp.com>
Differential Revision:	D3567
Sponsored by:		Nginx, Inc.

1 files changed, 10 insertions, 11 deletions

diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c
index fa278a8..a20bd81 100644
--- a/sys/netinet/tcp_subr.c
+++ b/sys/netinet/tcp_subr.c
@@ -1541,11 +1541,6 @@ tcp_ctlinput(int cmd, struct sockaddr *sa, void *vip)
 					 * in the route to the suggested new
 					 * value (if given) and then notify.
 					 */
-					bzero(&inc, sizeof(inc));
-					inc.inc_faddr = faddr;
-					inc.inc_fibnum =
-					    inp->inp_inc.inc_fibnum;
-
 				    	mtu = ntohs(icp->icmp_nextmtu);
 					/*
 					 * If no alternative MTU was
@@ -1560,14 +1555,18 @@ tcp_ctlinput(int cmd, struct sockaddr *sa, void *vip)
 						mtu = V_tcp_minmss +
 						    sizeof(struct tcpiphdr);
 					/*
-					 * Only cache the MTU if it
-					 * is smaller than the interface
-					 * or route MTU.  tcp_mtudisc()
-					 * will do right thing by itself.
+					 * Only process the offered MTU if it
+					 * is smaller than the current one.
 					 */
-					if (mtu <= tcp_maxmtu(&inc, NULL))
+					if (mtu < tp->t_maxopd +
+					    sizeof(struct tcpiphdr)) {
+						bzero(&inc, sizeof(inc));
+						inc.inc_faddr = faddr;
+						inc.inc_fibnum =
+						    inp->inp_inc.inc_fibnum;
 						tcp_hc_updatemtu(&inc, mtu);
-					tcp_mtudisc(inp, mtu);
+						tcp_mtudisc(inp, mtu);
+					}
 				} else
 					inp = (*notify)(inp,
 					    inetctlerrmap[cmd]);