Wednesday, September 12, 2018

CDN Cloudflare implements a more permanent fix to their PMTUD issue on IPv6. You won't have their problematic configuration, but remember not to block relevant ICMPv6 or you'll get the same effect.

"Fixing an old hack - why we are bumping the IPv6 MTU"

  1. Cloudflare gave themselves the original problem because they're abusing Anycast for stateful TCP and relying on ECMP to make the TCP flows sticky to one or another host, but this doesn't work for ICMP packets that apply to those flows.
  2. They worked around the problem at three and a half years ago by duplicating ICMPv6 to all hosts, and also by setting their sending MTU to IPv6 minium of 1280 bytes.
  3. Now they need a more-sophisticated fix [but they're not changing ECMP to be aware of ICMP, even though they could match ICMP payloads to a specific tuple and route appropriately].
  4. They were able to ignore this for IPv4, most probably because workarounds for broken PMTUD are borderline ubiquitous in IPv4: PMTUD blackhole discovery and TCP MSS clamping. The Linux kernel, specifically, uses Packetization Layer Path MTU Discovery (PLPMTUD) on IPv4 but not on IPv6.


No comments:

Post a Comment