mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
Johnathan Corgan
c969ca92c1
At the default settings the UDP transport MTU was 1280, so the TUN's effective IPv6 MTU was 1203 (1280 less the 77 bytes FIPS adds to an IPv6 packet). The TUN MTU is also 1280, so the host sent IPv6 packets of 1204 to 1280 bytes, and the node answered each with a Packet Too Big reporting 1203. A host must not lower its path MTU below 1280 on a Packet Too Big (RFC 8201), so it resent the same size and every such packet was lost. TCP was protected by the MSS clamp; UDP, ICMP and QUIC were not. The UDP transport's default MTU is now 1357, the smallest that carries a 1280-byte IPv6 packet, so a default node carries every IPv6 packet up to the IPv6 minimum. The datagram format is unchanged, and a 1357-byte datagram fits the receive buffer of a peer still at the old default. The daemon now warns when the TUN comes up, or once the transports are up when the application owns the TUN, if the operational transports give an effective IPv6 MTU below 1280, naming the transport MTU needed. The TUN still comes up. The IPv6-minimum constant that sizes the cold-flow MSS clamp moves to module level so the check shares it; the cold-flow clamp is unchanged. The configuration reference, the MTU, transport-layer and IPv6-adapter design notes, and the test template comment now state the new default. Tests cover a three-node chain at the default UDP MTU, which delivers 1280-byte IPv6 packets end to end with no Packet Too Big, the effective IPv6 MTU at the default, the shortfall the warning reports, the warning for a node whose application owns the TUN, and what a default node does toward a destination behind a forwarder whose transport MTU is 1280.
31 lines
748 B
YAML
31 lines
748 B
YAML
# FIPS Node {{NODE_NAME}} configuration ({{TOPOLOGY}} topology)
|
|
#
|
|
# Identity: {{NPUB}}
|
|
|
|
node:
|
|
identity:
|
|
nsec: "{{NSEC}}"
|
|
|
|
tun:
|
|
enabled: true
|
|
name: fips0
|
|
mtu: 1280
|
|
|
|
dns:
|
|
enabled: true
|
|
|
|
transports:
|
|
udp:
|
|
bind_addr: "0.0.0.0:2121"
|
|
# Docker bridge supports 1500-MTU IPv4 so 1472 is safe here.
|
|
# Operator-facing daemon default is 1357 (carries a 1280-byte IPv6 packet).
|
|
mtu: 1472
|
|
# recv_buf_size: 2097152 # 2 MB (default)
|
|
# send_buf_size: 2097152 # 2 MB (default)
|
|
# Note: The kernel clamps socket buffers to net.core.rmem_max / wmem_max.
|
|
# Ensure these sysctls are >= the configured buffer sizes:
|
|
# sysctl -w net.core.rmem_max=2097152
|
|
# sysctl -w net.core.wmem_max=2097152
|
|
|
|
peers:
|
|
{{PEERS}} |