Re: [tsvwg] Status of ECN encapsulation drafts (i.e., stuck)

"Rodney W. Grimes" <ietf@gndrsh.dnsmgr.net> Sun, 15 March 2020 17:30 UTC

Return-Path: <ietf@gndrsh.dnsmgr.net>
X-Original-To: tsvwg@ietfa.amsl.com
Delivered-To: tsvwg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 725893A1973 for <tsvwg@ietfa.amsl.com>; Sun, 15 Mar 2020 10:30:36 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.623
X-Spam-Level:
X-Spam-Status: No, score=-1.623 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, KHOP_HELO_FCRDNS=0.274, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c0kLRWxHqffx for <tsvwg@ietfa.amsl.com>; Sun, 15 Mar 2020 10:30:35 -0700 (PDT)
Received: from gndrsh.dnsmgr.net (br1.CN84in.dnsmgr.net [69.59.192.140]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE1603A1972 for <tsvwg@ietf.org>; Sun, 15 Mar 2020 10:30:34 -0700 (PDT)
Received: from gndrsh.dnsmgr.net (localhost [127.0.0.1]) by gndrsh.dnsmgr.net (8.13.3/8.13.3) with ESMTP id 02FHUSp5089225; Sun, 15 Mar 2020 10:30:28 -0700 (PDT) (envelope-from ietf@gndrsh.dnsmgr.net)
Received: (from ietf@localhost) by gndrsh.dnsmgr.net (8.13.3/8.13.3/Submit) id 02FHUSbk089224; Sun, 15 Mar 2020 10:30:28 -0700 (PDT) (envelope-from ietf)
From: "Rodney W. Grimes" <ietf@gndrsh.dnsmgr.net>
Message-Id: <202003151730.02FHUSbk089224@gndrsh.dnsmgr.net>
In-Reply-To: <5b8f776e-75ca-aaf6-0137-f8189db49259@bobbriscoe.net>
To: Bob Briscoe <ietf@bobbriscoe.net>
Date: Sun, 15 Mar 2020 10:30:28 -0700
CC: "Rodney W. Grimes" <ietf@gndrsh.dnsmgr.net>, Sebastian Moeller <moeller0@gmx.de>, "tsvwg@ietf.org" <tsvwg@ietf.org>
X-Mailer: ELM [version 2.4ME+ PL121h (25)]
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="US-ASCII"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tsvwg/8kiDac4CFPiBo44J9lCLvCPM2xU>
Subject: Re: [tsvwg] Status of ECN encapsulation drafts (i.e., stuck)
X-BeenThere: tsvwg@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Transport Area Working Group <tsvwg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tsvwg>, <mailto:tsvwg-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tsvwg/>
List-Post: <mailto:tsvwg@ietf.org>
List-Help: <mailto:tsvwg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tsvwg>, <mailto:tsvwg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 15 Mar 2020 17:30:37 -0000

> Rod,
> 
> On 14/03/2020 22:18, Rodney W. Grimes wrote:
> > Bob,
> > 	Questions and comments in line.
> >
> >
> >> Finding the best max packet size is an area where neither IPv4 nor IPv6
> >> has ever found a good solution. Getting a tunnel to fragment and
> >> reassemble is indeed painfully sub-optimal, but all the other solutions
> >> have their own problems. It is possible the sub-optimality is often
> >> going on under-the-covers, just because it works. I do know that, for
> >> IPv4, the Don't Fragment (DF) flag is often ignored by tunnels, as a
> >> preferable alternative to just ditching the traffic.
> >
> > What do you base your "know" on?
> > Can you please site an implementaiton?
> 
> Here's a selection of implementations that allow you to configure 
> clearing the DF flag in order to allow fragmentation prior to encapsulation:

Thank you for this Bob, that clears up things a fair bit.
Describing "configurable clearing of DF" as "often ignored
by tunnels..." is what lead to my questions.

> 
>   * Cisco IOS:
>     https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dplane/configuration/15-mt/sec-ipsec-data-plane-15-mt-book/sec-df-bit-ovride.html
>   * Juniper JunOS:
>     https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/clear-dont-fragment-bit-edit-interfaces.html
>   * Huawei:
>     https://support.huawei.com/enterprise/en/doc/EDOC1100034238/a1bd518c/optional-configuring-the-df-flag-bit-for-gre-packets
>   * Ericsson Redback:
>     http://rbman.ito.expert/en_lzn7830011_1_r4a/3_19082-CRA1191170_1-V1Uen.G.html#CHAPTER1.59
>   * Linux: iptables -t mangle -A PREROUTING -j DF --clear
> 
> While searching, I also found clear-df by accident in a firewall manual 
> (not even doing any tunnelling)
> 
> And I even discovered "clear-df" in an (expired) individual Internet 
> Draft from Ericsson for the Yang data model of an IPv4 tunnel:
> draft-liu-intarea-ipipv4-tunnel-yang-02
> 
> Note, these are not to be confused with suppressing propagation of DF=1 
> from the arriving IP header to the outer (so that a downstream router 
> within the tunnel is allowed to fragment). In Linux, that would be: 
> iptables -t mangle -A POSTROUTING -j DF --clear
> 
> So yes, I know this is often done, but I don't know how often.

Probably more often than desireable.
BUT this is done intentionally by an Operator, so I do not view
this as a severe a problem as if there actually was an implementation
that just flat out ignored DF.

> Bob
> Bob Briscoe                               http://bobbriscoe.net/
-- 
Rod Grimes                                                 rgrimes@freebsd.org