Subject: Re: [quicwg/base-drafts] Allow connections to share a port by adding restrictions on zero-length connection IDs (#2851)

From: Mike Bishop <[email-masked]>
Date: Tue, 13 Aug 2019 10:54:13 -0700

MikeBishop commented on this pull request.

-If the Destination Connection ID is zero length and the packet matches the
-address/port tuple of a connection where the host did not require connection
-IDs, QUIC processes the packet as part of that connection.  Endpoints SHOULD
-either reject connection attempts that use the same addresses as existing
-connections, or use a non-zero-length Destination Connection ID so that packets
-can be correctly attributed to connections.
+If the Destination Connection ID is zero-length and the packet matches the

```suggestion
If the Destination Connection ID is zero length and the packet matches the
```
[Don't hyphenate](https://www.grammarbook.com/punctuation/hyphens.asp) after the noun.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851#pullrequestreview-274453339

---

From: David Schinazi <[email-masked]>
Date: Tue, 13 Aug 2019 15:00:11 -0700

@DavidSchinazi pushed 1 commit.

435f24c67f3d7977316049bb40206c30b9253d11  Don't overenthusiastically hyphenate

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851/files/f659c0d3731fd6d9b332011455857cf342e49b3d..435f24c67f3d7977316049bb40206c30b9253d11

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 13 Aug 2019 17:58:44 -0700

janaiyengar commented on this pull request.

> @@ -924,11 +924,19 @@ selected by the client, both to ensure correct routing toward the client and to
 allow the client to validate that the packet is in response to an Initial
 packet.
 
-A zero-length connection ID MAY be used when the connection ID is not needed for
-routing and the address/port tuple of packets is sufficient to identify a
-connection. An endpoint whose peer has selected a zero-length connection ID MUST
-continue to use a zero-length connection ID for the lifetime of the connection
-and MUST NOT send packets from any other local address.
+A zero-length connection ID can be used when a connection ID is not needed
+to route to the correct endpoint. An endpoint SHOULD NOT use a zero-length
+connection ID unless it can use only its IP address and port to identify a
+connection. The IP address and port used by a peer cannot be used for routing

I thought we wanted to say that those weren't adequate on their own. I would also change this to active. "An endpoint SHOULD NOT use only the peer's IP address and port ..."

I would actually suggest dropping this sentence and the sentence after this one. You can go straight to the multiplexing sentence.

> @@ -924,11 +924,19 @@ selected by the client, both to ensure correct routing toward the client and to
 allow the client to validate that the packet is in response to an Initial
 packet.
 
-A zero-length connection ID MAY be used when the connection ID is not needed for
-routing and the address/port tuple of packets is sufficient to identify a
-connection. An endpoint whose peer has selected a zero-length connection ID MUST
-continue to use a zero-length connection ID for the lifetime of the connection
-and MUST NOT send packets from any other local address.
+A zero-length connection ID can be used when a connection ID is not needed
+to route to the correct endpoint. An endpoint SHOULD NOT use a zero-length
+connection ID unless it can use only its IP address and port to identify a
+connection. The IP address and port used by a peer cannot be used for routing
+or connection identification as these values can change during a connection's
+lifetime, and the peer can reuse a given address and port for additional
+connections. Similarly, the peer's connection IDs cannot be used for routing
+or identification, as they are not transmitted in the short header packets
+they send. Note that multiplexing while using zero-length connection IDs and

Suggested: "Multiplexing connections on the same local IP address and port while using zero-length connection IDs will cause failures in the presence of connection migration, NAT rebinding, and client
port reuse."  Drop the rest of this sentence -- its redundant with the "SHOULD NOT" above.

> @@ -924,11 +924,19 @@ selected by the client, both to ensure correct routing toward the client and to
 allow the client to validate that the packet is in response to an Initial
 packet.
 
-A zero-length connection ID MAY be used when the connection ID is not needed for
-routing and the address/port tuple of packets is sufficient to identify a
-connection. An endpoint whose peer has selected a zero-length connection ID MUST
-continue to use a zero-length connection ID for the lifetime of the connection
-and MUST NOT send packets from any other local address.
+A zero-length connection ID can be used when a connection ID is not needed
+to route to the correct endpoint. An endpoint SHOULD NOT use a zero-length
+connection ID unless it can use only its IP address and port to identify a

```suggestion
connection ID unless it can use only its local IP address and port to identify a
```

> -connection. An endpoint whose peer has selected a zero-length connection ID MUST
-continue to use a zero-length connection ID for the lifetime of the connection
-and MUST NOT send packets from any other local address.
+A zero-length connection ID can be used when a connection ID is not needed
+to route to the correct endpoint. An endpoint SHOULD NOT use a zero-length
+connection ID unless it can use only its IP address and port to identify a
+connection. The IP address and port used by a peer cannot be used for routing
+or connection identification as these values can change during a connection's
+lifetime, and the peer can reuse a given address and port for additional
+connections. Similarly, the peer's connection IDs cannot be used for routing
+or identification, as they are not transmitted in the short header packets
+they send. Note that multiplexing while using zero-length connection IDs and
+relying on the four-tuple of IP addresses and ports for routing will cause
+failures in the presence of connection migration, NAT rebinding, and client
+port reuse; and therefore MUST NOT be done unless an endpoint is certain that
+those protocol features are not in use.

I agree with @igorlord that there's redundancy here. Specifically, "endpoint SHOULD NOT use a zero-length connection ID unless it can use only its IP address and port" is at odds with "multiplexing while using zero-length connection IDs [...] MUST NOT be done". I've suggested fixes above.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851#pullrequestreview-274623600

---

From: David Schinazi <[email-masked]>
Date: Thu, 15 Aug 2019 18:37:27 -0700

95d1f8a66b7e9819b57f3b8241ba5cc43f55b102  Reduce redunancy

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851/files/435f24c67f3d7977316049bb40206c30b9253d11..95d1f8a66b7e9819b57f3b8241ba5cc43f55b102

---

From: David Schinazi <[email-masked]>
Date: Thu, 15 Aug 2019 18:37:35 -0700

DavidSchinazi commented on this pull request.

Done

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851#discussion_r314557345

---

From: David Schinazi <[email-masked]>
Date: Thu, 15 Aug 2019 18:37:52 -0700

Fixed

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851#discussion_r314557395

---

From: David Schinazi <[email-masked]>
Date: Thu, 15 Aug 2019 18:38:11 -0700

Swapped that around to remove the redundancy

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851#discussion_r314557423

---

From: David Schinazi <[email-masked]>
Date: Thu, 15 Aug 2019 18:38:22 -0700

Removed the redundancy

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851#discussion_r314557461

---

From: Martin Thomson <[email-masked]>
Date: Thu, 15 Aug 2019 19:43:07 -0700

martinthomson commented on this pull request.

> @@ -924,11 +924,12 @@ selected by the client, both to ensure correct routing toward the client and to
 
-A zero-length connection ID MAY be used when the connection ID is not needed for
-routing and the address/port tuple of packets is sufficient to identify a
-connection. An endpoint whose peer has selected a zero-length connection ID MUST
-continue to use a zero-length connection ID for the lifetime of the connection
-and MUST NOT send packets from any other local address.
+A zero-length connection ID can be used when a connection ID is not needed
+to route to the correct endpoint. However, multiplexing connections on the same
+local IP address and port while using zero-length connection IDs will cause
+failures in the presence of connection migration, NAT rebinding, and client port
+reuse; and therefore MUST NOT be done unless an endpoint is certain that those
+protocol features are not in use.

If I were to add commentary here, I would say "While this usage model appears to be substantially similar to common TCP connection idioms, the realities of UDP deployment mean that relying on peer addressing information for identifying connections can be significantly less reliable in UDP than TCP."

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851#pullrequestreview-275753946

---

From: Martin Thomson <[email-masked]>
Date: Thu, 15 Aug 2019 19:44:17 -0700

(Replying self, bad look, sorry.) Is this (^^) something that the applicability draft might want to say? @mirjak, @britram, WDYT?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851#discussion_r314566754

---

From: Martin Thomson <[email-masked]>
Date: Thu, 15 Aug 2019 21:45:41 -0700

@martinthomson pushed 1 commit.

5e388ac7dc9726e2ec60303eafd63d97f682255d  Merge branch 'master' into zerocid

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851/files/95d1f8a66b7e9819b57f3b8241ba5cc43f55b102..5e388ac7dc9726e2ec60303eafd63d97f682255d

---

From: Martin Thomson <[email-masked]>
Date: Thu, 15 Aug 2019 21:50:04 -0700

I rebased this.  There was a conflict that might be worth checking: @erickinnear rewrote the `disable_[active_]migration` bit.  Where this removed text forbidding migration with a zero-length connection ID, that text no longer appeared.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851#issuecomment-521882781

---

From: David Schinazi <[email-masked]>
Date: Fri, 16 Aug 2019 10:13:49 -0700

Both sound good to me, I agree that this is a good point to make, and the applicability draft sounds like a good home

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851#discussion_r314811588

---

From: David Schinazi <[email-masked]>
Date: Fri, 16 Aug 2019 10:14:03 -0700

Thanks for the rebase @martinthomson 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851#issuecomment-522083818

---

From: Eric Kinnear <[email-masked]>
Date: Fri, 16 Aug 2019 12:24:20 -0700

Rebase looks good to me too, thanks @martinthomson!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851#issuecomment-522123508

---

From: ianswett <[email-masked]>
Date: Fri, 16 Aug 2019 12:28:49 -0700

ianswett approved this pull request.

> @@ -954,11 +954,12 @@ selected by the client, both to ensure correct routing toward the client and to

```suggestion
failures in the presence of peer connection migration, NAT rebinding, and client port
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851#pullrequestreview-276130271

---

From: David Schinazi <[email-masked]>
Date: Fri, 16 Aug 2019 13:23:02 -0700

5f8281ab7c55a74e2bc0fdf9f2d1fdd4d9fbda1a  Specify peer connection migration

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851/files/5e388ac7dc9726e2ec60303eafd63d97f682255d..5f8281ab7c55a74e2bc0fdf9f2d1fdd4d9fbda1a

---

From: Martin Thomson <[email-masked]>
Date: Sun, 18 Aug 2019 18:36:33 -0700

5e7897e632412e99160678e68be658a153dc8bfc  rewrap

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2851/files/5f8281ab7c55a74e2bc0fdf9f2d1fdd4d9fbda1a..5e7897e632412e99160678e68be658a153dc8bfc