pMTU discovery

[David Woodhouse]

On Thu, 2012-05-31 at 15:58 +0200, Bernhard Schmidt wrote:
> 
> I saw this issue specifically with IPv6 transport, so we always have DF 
> bit set. I did not do much further debugging. Problem is that the tunnel 
> is configured with MTU 1406, but 1406 bytes don't really get across. At 
> least not from server to the client, the other direction seems to work 
> well. I guess the client stack is perfectly fine with pMTU discovery and 
> having to fragment it. I will debug this further.

Would be interesting to see this on the wire between client and server.
The server *ought* to be receiving 'too big' ICMP responses, and
reducing its idea of the MTU automatically.

Hm, that's a trick we probably need to do locally. Although when running
as non-root, adjusting the MTU dynamically is hard. I wonder if DTLS
allows us to fragment DTLS records over more than one UDP packet?

And I wonder if our version of OpenSSL is *automatically* doing that for
us, while Cisco's is not? That would explain the asymmetry.

-- 
dwmw2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 6171 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20120531/b678211d/attachment-0001.bin>