CONNECT-IP: a path MTU drop during an HTTP/3 tunnel black-holes packets instead of signalling or ending the tunnel #1237

What happens

docs/edge/masque-service.md (Packet size) says that over HTTP/3 a gVPC packet larger than the current QUIC datagram size gets an ICMPv6 Packet Too Big, and that when the path shrinks so a 1280-byte packet no longer fits, the request ends and the packet is counted as reason="path_mtu".

When the path MTU drops during an open HTTP/3 tunnel, neither happens. The server keeps the QUIC packet size it had already discovered, so connect-ip-go never finds a packet too large for a datagram. Oversized packets are dropped on the path without any ICMPv6 error, and once the path can no longer carry 1280-byte inner packets the tunnel stays open but carries none of them. Nothing is counted: galactic_connectip_packets_denied_total{reason="path_mtu"} and galactic_connectip_tunnel_ends_total{cause="path_mtu"} stay at zero.

The likely cause is in the transport, not the packet policy. quic-go v0.63.0 only grows its packet size through path MTU discovery and never shrinks it on loss, and on Linux it sets IPV6_PMTUDISC_PROBE, so the kernel ignores any Packet Too Big the socket receives. The server's DatagramTooLargeError check, which builds the Packet Too Big and drives the path_mtu ending, therefore never fires for a path that shrank after the handshake.

How it was seen

In the containerlab gVPC lab, with the MASQUE service from config/masque, a client sent 1280-byte ICMPv6 echo requests through an HTTP/3 tunnel to a workload every 100 ms. The workload also pinged the client's address with 1280-byte and 1400-byte packets. The MTU of the provider pod's host-side veth was then lowered every 9 s:

The provider's metrics showed no path_mtu drop or tunnel end; the only tunnel end counted was the client's own close.

Expected

As documented: above the 1280-byte floor, an oversized gVPC packet draws an ICMPv6 Packet Too Big to its sender; below it, the tunnel ends and the drop is counted as path_mtu, so the connector reconnects and the 1280-byte admission probe decides whether the path still works.

Related

#982 (lab rows for live path MTU changes). The MASQUE service lab suite's mtu-live-drop row reproduces this and fails until it is fixed.