Subject: Re: [Masque] HTTP Datagrams and MTU handling

From: Spencer Dawkins at IETF <[email-masked]>
Date: Thu, 9 Sep 2021 15:24:08 -0500

Hi, Magnus,

My apologies for a sluggish response to a direct question to me. I'm now
awake.

On Mon, Aug 30, 2021 at 4:49 AM Magnus Westerlund <
[email-masked]> wrote:

> On Fri, 2021-08-27 at 14:51 -0400, Ben Schwartz wrote:
> > On Fri, Aug 27, 2021 at 4:11 AM Magnus Westerlund <
> > [email-masked]> wrote:
> > ...
> > > I hope you don't think you can apply that logic to dropping tunneled
> packets
> > > that are 1280 or smaller size due to MTU issues. Becasue the PLPMTUD do
> > > assume
> > > that IPv6 1280 packet size will work and thus also they will fail to
> handle
> > > the
> > > situation if 1280 bytes are not supported.
> >
> > PLPMTUD algorithms can be updated to avoid this assumption.  Of course,
> there
> > might be an install base of software that has this assumption baked in.
> >
>
> I still think there are a number of IP usages that do assume certain base
> MTUs
> will work because they are assumed to be below minimal and don't have any
> form
> of PLPMTUD implemented.
>
> > ...
> > > I think sending ICMP PTBs would be good especially if that is minor
> > > extension of
> > > the mechanism to handle how we ensure that <=1280 bytes IPv6 packets
> can be
> > > sent.
> >
> > I don't think this would suffice.  If we need to support PLPMTUD that
> assumes
> > a 1280-byte minimum, presumably we also need to support ICMPv6-based
> PMTUD
> > that assumes a 1280-byte minimum.  A PTB message that says "1280 is too
> big"
> > won't be good enough.
> >
> > I expect that the best solution is to direct such stiff endpoints to the
> > reliable transport (non-DATAGRAM), which has enormous MTU, and declare
> that
> > CONNECT-IP in DATAGRAM mode does not comply with the IP MTU rules.  If
> that's
> > not sufficient, I think we'll need a mechanism for "forward
> reliability", with
> > intermediaries upgrading oversize datagrams to the reliable transport.
>
> Yes, we do have a reliable mode we can use. My argument is how the MASQUE
> ingresses can determine when it is necessary to use this reliable mode for
> packets to get them from MASQUE ingres to MASQUE egress. Simply dropping
> any
> datagram that is oversized for the actual MTU will not work. There need to
> be
> more functionality somewhere in the MASQUE system. If that is running
> ingress to
> egress regular probing or a feedback mechanism to ingress that one dropped
> the
> packet I don't care.

Fortunately, you and Ben managed to carry forward without me, but this is
where I was headed. If the MASQUE answer turns out to be that something
like PMTUD is happening inside an encrypted tunnel, so that no helpful
intermediary can make the decision to blackhole ICMP PTB, that's probably
not the kind of problem we were talking about in 2017.

Of course, reading the further discussion in this thread about switching
from datagrams to streams is now giving me "DNS response truncation so you
should switch to TCP" nightmares, but we'll see where we end up. 😱

Best,

Spencer

> Cheers
> Magnus