fix(wt_bridge): default QUIC initial packet size to 1200 for VPN paths#373
Merged
Conversation
The previous default (quic-go's 1252 bytes → 1280 total IP packet) silently fails on paths with reduced MTU, such as VPN tunnels between subnets. The server's Initial response exceeds the path MTU, gets dropped, and the browser times out with QUIC_HANDSHAKE_TIMEOUT because it never receives the ServerHello needed to derive handshake keys — while smaller Handshake packets arrive as undecryptable orphans. Default to 1200 bytes (the QUIC-mandated minimum, RFC 9000 §14) so the bridge works out of the box on any routable path. Add --initial-mtu (1200–1452) for operators who know their path MTU and want larger packets. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
InitialPacketSizeto 1200 bytes (QUIC minimum per RFC 9000§14) instead of quic-go's default of 1252. On paths with reduced MTU
(e.g. VPN tunnels between subnets with path MTU ≤ 1280), the server's
coalesced Initial+Handshake datagram at 1252+28 = 1280 bytes rides the
exact MTU edge. When it exceeds the path MTU the Initial response is
silently dropped, the browser never receives the ServerHello, and Chrome
reports
QUIC_HANDSHAKE_TIMEOUTwithnum_undecryptable_packets: 7(Handshake packets arrive but can't be decrypted without the missing
Initial).
--initial-mtuflag (1200–1452) so operators with known higherpath MTU can opt in to larger packets.
Test plan
go buildpasses (verified locally)(path MTU 1280) — verify WebTransport handshake succeeds
--initial-mtu 1452on a same-subnet setup — verify it still works🤖 Generated with Claude Code