Subject: [quicwg/base-drafts] Change the UDP port sometimes too (#1269)

From: Martin Thomson <[email-masked]>
Date: Thu, 05 Apr 2018 17:38:29 -0700

As discussed on-list, changing the UDP port at the same time as changing the connection ID makes good sense, if only to ensure that migration is exercised.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/1269

-- Commit Summary --

  * Change the UDP port sometimes too

-- File Changes --

    M draft-ietf-quic-transport.md (11)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/1269.patch
https://github.com/quicwg/base-drafts/pull/1269.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1269

---

From: Christian Huitema <[email-masked]>
Date: Thu, 05 Apr 2018 19:49:35 -0700

huitema commented on this pull request.

Yes, very much the idea I was alluding too on the list. The caveat is that clients want to be careful to not too that too often, because somd NAT boxes fall over after more than small N number of ports are open. But doing that after 10-20 sec on idle should be just fine.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1269#pullrequestreview-109934677

---

From: Brian Trammell <[email-masked]>
Date: Fri, 06 Apr 2018 07:03:10 +0000 (UTC)

+1 to CID rotation being pointless if we don't do this. However, this seems dangerous if not done carefully, and it links CID rotation rate to the maximum usable UDP port consumption rate.

Note that QUIC presently doesn't have an advisory on-path state clearance signal (we discussed this as a signal bound to public reset in #20, but it morphed into Stateless Reset, which has completely different semantics), which means that there is neither a present nor yet a potential future method to reduce the NAT state load this will generate.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1269#issuecomment-379166742

---

From: MikkelFJ <[email-masked]>
Date: Fri, 06 Apr 2018 01:45:54 -0700

UDP could also have a recommended client port when used with client CID, then the port does not leak information.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1269#issuecomment-379189108

---

From: mirjak <[email-masked]>
Date: Fri, 06 Apr 2018 09:30:51 +0000 (UTC)

If you are behind an NAT and change your source port, you might also get a new outer IP address which would lead to path validation and congestion control reset at the server. Nor sure if you want to risk that every 10ms. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1269#issuecomment-379200523

---

From: ianswett <[email-masked]>
Date: Fri, 06 Apr 2018 06:04:32 -0700

ianswett commented on this pull request.

> @@ -1763,9 +1763,14 @@ gap than it advertised.
 
 Clients MAY change connection ID at any time based on implementation-specific
 concerns.  For example, after a period of network inactivity NAT rebinding might
-occur when the client begins sending data again. A client might wish to reduce
-linkability by employing a new connection ID when sending traffic after a period
-of inactivity.
+occur when the client begins sending data again.
+
+A client might wish to reduce linkability by employing a new connection ID and
+source UDP port when sending traffic after a period of inactivity.  Changing the

This may have a performance impact if the server interprets this is a full migration and not just a NAT rebind.  I think it's worth noting that as well as that this may cause the server to perform path validation before sending any significant data?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1269#pullrequestreview-110054507

---

From: Christopher Wood <[email-masked]>
Date: Fri, 06 Apr 2018 17:29:39 +0000 (UTC)

@huitema @britram Out of curiosity, do either of you have data on middleboxes that may not handle port rotation well?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1269#issuecomment-379322184

---

From: Martin Thomson <[email-masked]>
Date: Mon, 09 Apr 2018 00:31:10 +0000 (UTC)

@martinthomson pushed 1 commit.

b243982  Changing port number has consequences

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1269/files/7c3128c17c4c63ec47b1071df2129dd995e3646c..b2439828256873a5596f58172af196746e9c4900

---

From: Martin Thomson <[email-masked]>
Date: Sun, 08 Apr 2018 17:31:47 -0700

I've added text about the consequences of port number change, and advised that it only be done infrequently. @chris-wood, see the list for discussion about port rotation: infrequent changes should be fine based on that.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1269#issuecomment-379595777

---

From: ianswett <[email-masked]>
Date: Mon, 09 Apr 2018 15:33:14 +0000 (UTC)

> @@ -1763,9 +1763,16 @@ gap than it advertised.
 
 Clients MAY change connection ID at any time based on implementation-specific
 concerns.  For example, after a period of network inactivity NAT rebinding might
-occur when the client begins sending data again. A client might wish to reduce
-linkability by employing a new connection ID when sending traffic after a period
-of inactivity.
+occur when the client begins sending data again.
+
+A client might wish to reduce linkability by employing a new connection ID and
+source UDP port when sending traffic after a period of inactivity.  Changing the
+UDP port from which it sends packets at the same time might cause the packet to
+appear as a connection migration. This ensures that the mechanisms that support
+migration are exercised even for clients that don't experience NAT rebindings or
+genuine migrations.  Changing port number can cause a peer to reset its
+congestion state (see {{migration-cc}}), so this action SHOULD only be changed

"so this action SHOULD only be changed infrequently." is not quite right.  Did you intend "so this action SHOULD only be taken infrequently."?  Or "the port SHOULD only be changed infrequently."?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1269#pullrequestreview-110503643

---

From: Mike Bishop <[email-masked]>
Date: Mon, 09 Apr 2018 14:26:24 -0700

MikeBishop approved this pull request.

LGTM, modulo the fix Ian suggested.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1269#pullrequestreview-110623318

---

From: Martin Thomson <[email-masked]>
Date: Tue, 10 Apr 2018 00:43:15 +0000 (UTC)

4e9d4cd  Get it right boy

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1269/files/b2439828256873a5596f58172af196746e9c4900..4e9d4cdd4f40571d74e8730d4af1243813fcc67a

---

From: Martin Thomson <[email-masked]>
Date: Mon, 09 Apr 2018 17:43:37 -0700

Merged #1269.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1269#event-1565072976