Re: [secdir] Secdir review of draft-ietf-tls-record-limit

[Martin Thomson <[e-mail]>]

On Sat, Feb 24, 2018 at 6:17 AM, Benjamin Kaduk <[e-mail]> wrote:
> The record size limit is a cap, not a mandatory record size.

That's right.  Alan, does that address your primary concern?

> On Fri, Feb 23, 2018 at 09:49:11AM -0500, Alan DeKok wrote:
>>   RFC 6347 Section 4.1.1.1 gives some guidance, but I think not enough.  Exposing the MTU to the application is good, but what does the application *do* with this information?

In many cases, nothing.

My understanding of DTLS implementations is that the size of a write
determines the size of the packet that is ultimately sent.  Say I
write 100 octets to the socket, so DTLS writes out a record of 128
octets.

What stacks do when a write exceeds PMTU differs.  The same applies to
this new limit:

* The stack I work on splits records based on its understanding of the
MTU, but it only learns that during the handshake and so relies mostly
on the application making smaller writes.  (There is currently no way
to set the MTU, which is an open bug.)  It also sends a single record
in each packet for application data, so the net effect of a large
write is multiple UDP datagrams with one record each.

If your stack operates like this, then the information is pretty much
just advisory.  The only thing you might contemplate is changing any
coalescing rules you might have to compensate.

* If a stack did automatic splits, but then put multiple records in
the same datagram, that's the same for a using application.

* If a stack rejects large writes and forces the application to write
within its constraints, then that stack needs to be clear about what
limit was in force, such as through the use of specific error codes.
Such stack that adds this feature would need to be careful about
introducing this feature.