Re: [TLS] Last Call: <draft-ietf-tls-rfc4347-bis-04.txt> (Datagram Transport Layer Security version 1.2) to Proposed Standard

[Florian Weimer <[e-mail]>]

* Pekka Savola:

>    If there is a transport protocol indication (either via ICMP or via a
>    refusal to send the datagram as in DCCP Section 14), then DTLS record
>    layer should inform the upper layer protocol of the error.
>
> .. is this too weak?  I've have thought that it would be natural that if
> DTSLS record layer gets this notification (which, in the case of ICMP and
> omitting information, is not necessarily given), it MUST pass this
> information up. Note that the refusal to send could also apply to UDP
> if packet is bigger than PMTU and DF bit is set or IPv6 is used.
> What is the alternative if it doesn't?  It would be fine if
> the alternative is that the DTLS record layer react to that information
> itself, but completely ignoring e.g. ICMP packet too big would lead to
> communication failure.

ICMP packet too big is typically handled by the stack, not the
application.  The stack updates the stored path MTU, the application
tries again, and this time, the stack produces smaller fragments.

AFAIUI, requiring ICMP processing in applications prescribes an
implementation model based on connected UDP sockets (in the
terminology of the BSD sockets API).  This is not always desirable or
possible.

-- 
Florian Weimer                <[e-mail]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: [phone]
D-76133 Karlsruhe             fax: [phone]