Subject: [quicwg/base-drafts] Is path validation a SHOULD or a MUST -- pick one! (#2580)

From: Igor Lubashev <[email-masked]>
Date: Mon, 01 Apr 2019 05:15:03 -0700

Section 9 (Connection Migration) says:

> [...] an endpoint SHOULD perform path validation (Section 8.2) if it detects a change in the IP address of its peer.

Section 9.2 (Responding to Connection Migration) says:

> In response to such a packet [a packet from a new peer address containing a non-probing frame], an endpoint MUST start sending subsequent packets to the new peer address and MUST initiate path validation (Section 8.2) to verify the peer’s ownership of the unvalidated address.

So:

1. Is performing path validation (Section 8.2) a SHOULD or a MUST?  I would prefer "a MUST, unless the endpoint has other means validate the validate the new path"

2. If sending subsequent packets immediately a MUST?  Not even a "MUST after validation"?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2580

---

From: Lars Eggert <[email-masked]>
Date: Tue, 16 Apr 2019 00:53:23 -0700

This is almost an editorial issue, except that we need to agree on MUST vs. SHOULD. Please comment, folks.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2580#issuecomment-483551799

---

From: ianswett <[email-masked]>
Date: Tue, 16 Apr 2019 07:11:24 -0700

I think Igor's suggestion of "a MUST, unless the endpoint has other means validate the validate the new path" seems sensible, but either way this needs a PR.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2580#issuecomment-483676270

---

From: Jana Iyengar <[email-masked]>
Date: Wed, 17 Apr 2019 11:27:42 -0700

I like @igorlord 's suggestion, but I suspect @erickinnear's upcoming PR that addresses #2582 (and #2579) will cover this too. Let's wait for that one first, since it should have more context and rationale.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2580#issuecomment-484207816

---

From: MikkelFJ <[email-masked]>
Date: Wed, 17 Apr 2019 12:00:45 -0700

I intuitively like MUST, but what would the implications be of SHOULD? Would it broaden the attack surface? Probably. Implications of MUST: could an attacker force validation work by injection? How bad could that get?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2580#issuecomment-484219423

---

From: erickinnear <[email-masked]>
Date: Wed, 17 Apr 2019 12:52:40 -0700

I think elsewhere we had a "MUST, unless" for some of this, so sticking with that would be great (to second Igor and Ian's comments).

Re: SHOULD, agreed that it would potentially broaden the attack surface, since some of the mitigations (the reason for the MUST in 9.2) rely on validation being performed.

The attacker can cause you to generate validation packets by injection, but I think the discussion in #2582 should attempt to consider the implications of what happens when you end up validating on every incoming packet (the worst possible case here, and definitely a good thing to think about).

My intent here is to put the non-editorial changes in a small PR to get the normative language right and then potentially follow with a larger PR that's (hopefully) purely editorial that rearranges these to get rid of some of the confusion around having requirements split across the sections.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2580#issuecomment-484236423

---

From: Lars Eggert <[email-masked]>
Date: Wed, 17 Apr 2019 23:43:21 -0700

FWIW, a "MUST, unless" is exactly what a SHOULD is

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2580#issuecomment-484376576

---

From: Igor Lubashev <[email-masked]>
Date: Thu, 18 Apr 2019 00:03:56 -0700

@larseggert, SHOULD is a lot weaker than "MUST, unless" because SHOULD allows skipping the behavior even if the "unless" part is not performed.

"MUST A, unless B" is a syntactic sugar for "MUST A or B".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2580#issuecomment-484381663

---

From: Lars Eggert <[email-masked]>
Date: Mon, 22 Apr 2019 23:45:11 -0700

>From 2119:
```
3. SHOULD   This word, or the adjective "RECOMMENDED", mean that there
   may exist valid reasons in particular circumstances to ignore a
   particular item, but the full implications must be understood and
   carefully weighed before choosing a different course.
```
And those circumstances should be discussed, which is the "unless" part.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2580#issuecomment-485664630