Subject: Re: [quicwg/base-drafts] CID change still required in response to migration? (#2778)

From: Lars Eggert <[email-masked]>
Date: Tue, 02 Jul 2019 23:15:35 -0700

I think the issue is that there are two types of migration: "Direct" migration, where an endpoint changes to a new path and it is in their interest to also change the CID (to reduce trackability), and "indirect" migration, i.e., NAT rebinding, where a middlebox changes the path for an endpoint in a way that they are unaware of and therefore cannot initiate a CID migration for. Both of there are valid, but they are slightly different.

Is it sufficient to clarify that for a direct migration, a CID change SHOULD happen, and for an indirect migration, it (generally) cannot, and that the peer must handle both?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2778#issuecomment-507954847

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 02 Jul 2019 23:39:19 -0700

@larseggert I like the way you categorize migration.

> Is it sufficient to clarify that for a direct migration, a CID change SHOULD happen, and for an indirect migration, it (generally) cannot, and that the peer must handle both?

Does that mean in practical sense that clients SHOULD change CID for direct migration, and that servers SHOULD respond to a CID change with a CID change?

Assuming that is what we are seeking, I think it might be a good idea to clarify using a non-RFC2199 term that is effectively what we recommend (I understand that we prefer talking about "endpoints").

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2778#issuecomment-507961252

---

From: Tatsuhiro Tsujikawa <[email-masked]>
Date: Wed, 03 Jul 2019 01:09:23 -0700

Client don't change CID in indirect migration because it does not aware of it.
Regardless of direct or indirect migration, server knows the packet is coming from new path (new remote address and/or port). 
So the question is server MAY/SHOULD/MUST change CID when sending a packet to new path.

Current draft says that it is MUST to change CID on direct migration:

> An endpoint MUST use a new connection ID if it initiates connection migration.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2778#issuecomment-507988206

---

From: MikkelFJ <[email-masked]>
Date: Wed, 03 Jul 2019 02:02:03 -0700

An option would also to keep MUST change CID on direct migration and add that a en endpoint SHOULD not reject a migration that doesn't change CID because it might be a valid indirect migration. An endpoint MAY, however, reject indirect migrations that do not change CID if this is privacy is considered more important than broad interop (this is controversial).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2778#issuecomment-508007306

---

From: MikkelFJ <[email-masked]>
Date: Wed, 03 Jul 2019 02:05:09 -0700

Either way, I think it would be beneficial if the text has a section with clear definition of the terms "direction migration" and "indirect migration".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2778#issuecomment-508008427

---

From: Lars Eggert <[email-masked]>
Date: Wed, 03 Jul 2019 09:48:16 -0700

@tatsuhiro-t bit when a server sees the client using a new path (because of a NAT rebind) the server is not the one *initiating* the migration 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2778#issuecomment-508171246