Subject: Re: [Syslog] AD review discuss/comments for draft-ietf-syslog-dtls

From: "Tim Evens" <[email-masked]>
Date: Tue, 25 May 2010 10:24:00 -0400

See inline...-----Original Message-----From: [email-masked]: 05/25/2010 03:54 AMRFC 4346 (from which this text comes from) mostly did not use RFC2119 keywords, but instead informal language like the lowercase "should not" you quoted. AFAIK it was meant to express a strict limit, not a recommendation (this is implied by other text in the spec, and as you noticed, we clarified this in RFC 5246).  But even though DTLS records are limited to 2^14 bytes, syslog messages are not! The current spec seems to support 64K (minus some small number of overhead) just fine -- the message will be split to multiple DTLS records (max. 2^14 bytes each), but those  DTLS records are then combined to a single UDP datagram. <tievens> Ahh... Only if DTLS sequence numbers are used and if they are implemented using a reorder queueing method can a message be split into "chunks" that are transmitted over multiple DTLS records. This leads to the issue of what happens when a packet is dropped?   Even if you follow the DTLS sequence numbers, UDP and DTLS do not support retransmission, thus that lost packet is lost forever. This would lead to one message "chunk" being concatenated with a different message altogether.  This is why I was suggesting a SYSLOG-FRAME-ID. </tievens> Best regards, Pasi

---

From: <[email-masked]>
Date: Wed, 26 May 2010 07:57:09 +0200

Tim Evens wrote:
>> But even though DTLS records are limited to 2^14 bytes, syslog
>> messages are not! The current spec seems to support 64K (minus some
>> small number of overhead) just fine -- the message will be split to
>> multiple DTLS records (max. 2^14 bytes each), but those DTLS
>> records are then combined to a single UDP datagram.
>
> Ahh... Only if DTLS sequence numbers are used and if they are
> implemented using a reorder queueing method can a message be split
> into "chunks" that are transmitted over multiple DTLS records.

No -- even if you split a message to multiple DTLS records, all those
records are sent in a *single* UDP datagram, in order. So there's
no need to queue/reorder packets based on DTLS sequence numbers.

(The one UDP datagram might, of course, get fragmented to several
IP packets, but this happens below UDP and DTLS, so DTLS sequence
numbers are not involved...)

Best regards,
Pasi