Subject: [quicwg/base-drafts] Clarify flow control issues on stream 0 (#1082)

From: Mike Bishop <[email-masked]>
Date: Mon, 29 Jan 2018 23:14:28 +0000 (UTC)

Fixes #1074, #725 - these are similar problems around flow control on stream zero.

Stream 0 isn't bound to obey connection-level flow control, which necessarily means that it can't consume connection-level flow control either.  That was previously incorrect, since the definition of connection flow control repeatedly referred to "all streams."

On the other hand, Stream 0 can get stalled by stream-level flow control and the client isn't allowed to give it more credit.  This permits Stream 0 to "surge" until the end of the handshake, but then it has to wait for the client to give it more credit until it catches up.

Finally, that surge could provoke an amplification attack if a server has a really large handshake message.  The proposed mitigation to that is to require address validation before sending more than N times the client's initial packet size; since the client has an initial minimum packet size, that can be simplified to N Handshake packets from the server.  I've arbitrarily chosen N=3, but happy to bikeshed that.  I'm not certain I've landed that restriction in the best place, so feel free to suggest moving it elsewhere entirely.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/1082

-- Commit Summary --

  * Clarify flow control issues on stream 0
  * Really, not zero

-- File Changes --

    M draft-ietf-quic-transport.md (26)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/1082.patch
https://github.com/quicwg/base-drafts/pull/1082.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1082

---

From: Martin Thomson <[email-masked]>
Date: Mon, 29 Jan 2018 15:20:53 -0800

Hah, I was working on exactly the same thing.  I prefer a different approach here.  I was just about to submit the PR.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1082#issuecomment-361421529

---

From: Mike Bishop <[email-masked]>
Date: Tue, 30 Jan 2018 00:45:14 +0000 (UTC)

I may have erred in conflating three separable items in this PR.

1. The handshake exemption is effectively the same as allowing the flow control window to grow without cryptographic verification, then snapping it shut again once the crypto is in place.  I like that better than "undoing" the credit granted in the clear, but they're effectively equivalent.
2. Either of these produces an amplification attack possibility from a server with a large certificate.  Such an attacker won't give you a small flow control window.  The fixed multiple is an attempt to mitigate that.
3. Fixing #1074 is connection-level flow control.

Let's take them separately -- (1) is an alternative approach to what you've done in #1083 , and I'd argue it's simpler.  Rather than allowing spoofable MAX_STREAM_DATA frames, it just extends the exemption you give to Initial and Reset to the entire handshake.

Either way, we need to limit the amplification possibility of large server handshakes as in (2).  I hear you that a fixed multiple "cannot work" -- better suggestions?

Would these work better as separate PRs?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1082#issuecomment-361437631

---

From: Martin Thomson <[email-masked]>
Date: Tue, 30 Jan 2018 01:02:41 +0000 (UTC)

1 requires a fixed limit.  That's what I'm objecting to here.  I don't think that we can reasonably limit the size of a certificate chain that way.

2 is already addressed by congestion control and constraints on address validation.

I agree that 3 is separable, but I don't see much value in trying to do a two-step here, since it is all the same text.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1082#issuecomment-361441180

---

From: Mike Bishop <[email-masked]>
Date: Tue, 30 Jan 2018 23:32:01 +0000 (UTC)

Based on the conversation just now, I'll lift (2) out of this PR and create a new one once @janaiyengar's PATH_CHALLENGE frame lands.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1082#issuecomment-361770911

---

From: Mike Bishop <[email-masked]>
Date: Thu, 01 Feb 2018 00:31:21 +0000 (UTC)

@MikeBishop pushed 2 commits.

eca60b8  Extract amplification mitigation
26521a1  Clarify handshake exemption

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1082/files/2fa05ac4dc6259ddea18a3d0f83ea33788e20408..26521a16e9a2ceb9cbdba6c359fbde582165e976

---

From: Mike Bishop <[email-masked]>
Date: Wed, 31 Jan 2018 16:35:53 -0800

@MikeBishop pushed 1 commit.

ee3909c  Just to be perfectly clear....

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1082/files/26521a16e9a2ceb9cbdba6c359fbde582165e976..ee3909c42bfb174da183b7ccfba0a37c37040623

---

From: Martin Thomson <[email-masked]>
Date: Thu, 01 Feb 2018 00:38:15 +0000 (UTC)

martinthomson approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1082#pullrequestreview-93135215

---

From: ianswett <[email-masked]>
Date: Thu, 01 Feb 2018 01:04:53 +0000 (UTC)

ianswett approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1082#pullrequestreview-93139561

---

From: Marten Seemann <[email-masked]>
Date: Thu, 01 Feb 2018 01:07:11 +0000 (UTC)

marten-seemann approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1082#pullrequestreview-93139901