Subject: [quicwg/base-drafts] Forbid use of application-level close in Initial, Handshake packets (#3164)

From: Kazuho Oku <[email-masked]>
Date: Mon, 28 Oct 2019 18:30:56 -0700

As discussed in #3158, use of application-level close is problematic in Initial / Handshake packets.

This PR address the issue by limiting the use of that to 1-RTT packets, at the same time advising applications to use user_canceled TLS alert to abort the connection during the handshake.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/3164

-- Commit Summary --

  * 0x1d only in 1-RTT; suggest user_canceled alert

-- File Changes --

    M draft-ietf-quic-tls.md (7)
    M draft-ietf-quic-transport.md (6)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/3164.patch
https://github.com/quicwg/base-drafts/pull/3164.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164

---

From: Marten Seemann <[email-masked]>
Date: Mon, 28 Oct 2019 19:41:11 -0700

marten-seemann approved this pull request.

I think this is the right way to go, since during the non-0-RTT handshake, the peers don't agree on the application protocol.
However, I've written in https://github.com/quicwg/base-drafts/issues/3158#issuecomment-547228733, I think we might need a way to communicate an application-level error code for 0-RTT connections.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164#pullrequestreview-308248514

---

From: Martin Thomson <[email-masked]>
Date: Tue, 29 Oct 2019 15:21:13 -0700

martinthomson approved this pull request.

> @@ -5503,6 +5503,12 @@ Reason Phrase:
   zero length if the sender chooses to not give details beyond the Error Code.
   This SHOULD be a UTF-8 encoded string {{!RFC3629}}.
 
+The application-specific variant of CONNECTION_CLOSE (type 0x1d) can only be
+sent using an 1-RTT packet ({{QUIC-TLS}}; section 4).  An application can close

```suggestion
sent using an 1-RTT packet ({{QUIC-TLS}}, Section 4).  An application can close
```

> @@ -5503,6 +5503,12 @@ Reason Phrase:
   zero length if the sender chooses to not give details beyond the Error Code.
   This SHOULD be a UTF-8 encoded string {{!RFC3629}}.
 
+The application-specific variant of CONNECTION_CLOSE (type 0x1d) can only be
+sent using an 1-RTT packet ({{QUIC-TLS}}; section 4).  An application can close
+the connection during the handshake by sending a CONNECTION_CLOSE frame (type
+0x1c) with an error code of 0x15a ("user_canceled" alert; see {{?TLS13}}) in an
+Initial or a Handshake packet.

Is this "An application that wishes to abandon a connection during the handshake [...]"?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164#pullrequestreview-308863025

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 29 Oct 2019 22:38:25 -0700

@kazuho pushed 1 commit.

96cc1e384b7c65767c7d9bd23130f23c30244b5f  Update draft-ietf-quic-transport.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164/files/3e153569a5f25801e5711cc26236d28f034c70b6..96cc1e384b7c65767c7d9bd23130f23c30244b5f

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 29 Oct 2019 22:43:38 -0700

@kazuho pushed 1 commit.

c0b9c9307ddd840fb32bfc1c151040ab569b49fd  an app that wishes to do so can

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164/files/96cc1e384b7c65767c7d9bd23130f23c30244b5f..c0b9c9307ddd840fb32bfc1c151040ab569b49fd

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 29 Oct 2019 22:44:00 -0700

kazuho commented on this pull request.

Definitely! Applied in c0b9c93. Thank you.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164#discussion_r340438249

---

From: Marten Seemann <[email-masked]>
Date: Tue, 29 Oct 2019 22:47:09 -0700

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164#pullrequestreview-308974444

---

From: MikkelFJ <[email-masked]>
Date: Wed, 30 Oct 2019 00:14:06 -0700

mikkelfj commented on this pull request.

+The application-specific variant of CONNECTION_CLOSE (type 0x1d) can only be
+sent using an 1-RTT packet ({{QUIC-TLS}}, Section 4).  An application that
+wishes to abandon a connection during the handshake can send a CONNECTION_CLOSE
+frame (type 0x1c) with an error code of 0x15a ("user_canceled" alert; see
+{{?TLS13}}) in an Initial or a Handshake packet.
+

Applications cannot send frames so this requires that the API supports it, which I think they should be recommended to support, but not necessarily be required to support.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164#pullrequestreview-308997960

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 30 Oct 2019 00:24:52 -0700

@kazuho pushed 1 commit.

eb30e2a0b1f7318a21a326a2481c8c278a902e7d  application does not send a frame

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164/files/c0b9c9307ddd840fb32bfc1c151040ab569b49fd..eb30e2a0b1f7318a21a326a2481c8c278a902e7d

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 30 Oct 2019 00:25:06 -0700

Good point. Addressed in eb30e2a.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164#discussion_r340459770

---

From: Nick Banks <[email-masked]>
Date: Wed, 30 Oct 2019 06:49:38 -0700

nibanks approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164#pullrequestreview-309213340

---

From: ianswett <[email-masked]>
Date: Wed, 30 Oct 2019 10:00:51 -0700

ianswett approved this pull request.

> @@ -328,8 +328,11 @@ encryption levels:
 
 - PADDING and PING frames MAY appear in packets of any encryption level.
 
-- CRYPTO and CONNECTION_CLOSE frames MAY appear in packets of any encryption
-  level except 0-RTT.
+- CRYPTO frames and CONNECTION_CLOSE frames signaling errors at QUIC layer (type
+  0x1c) MAY appear in packets of any encryption level except 0-RTT.
+
+- CONNECTION_CLOSE frames signaling application errors (type 0x1d) MUST only be
+  sent in 1-RTT level.

```suggestion
  sent in the 1-RTT encryption level.
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164#pullrequestreview-309368549

---

From: Martin Thomson <[email-masked]>
Date: Wed, 30 Oct 2019 16:21:35 -0700

Or

```suggestion
  sent in packets at the 1-RTT encryption level.
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164#pullrequestreview-309577060

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 30 Oct 2019 16:34:35 -0700

@kazuho pushed 1 commit.

ce608aac8ea116d554c7fd32dc2199d215db9a24  Update draft-ietf-quic-tls.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164/files/eb30e2a0b1f7318a21a326a2481c8c278a902e7d..ce608aac8ea116d554c7fd32dc2199d215db9a24

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 30 Oct 2019 16:35:19 -0700

Thank you for the suggestions. When with the most verbose and easy to understand one.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164#discussion_r340905752

---

From: Mike Bishop <[email-masked]>
Date: Thu, 31 Oct 2019 12:29:00 -0700

MikeBishop approved this pull request.

 

at "the" QUIC layer (or the transport layer)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164#pullrequestreview-310130970

---

From: Kazuho Oku <[email-masked]>
Date: Thu, 31 Oct 2019 22:24:42 -0700

@kazuho pushed 1 commit.

408ba486db7c1fdea3d0049379a1a56934e1f78d  "the" @MikeBishop

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164/files/ce608aac8ea116d554c7fd32dc2199d215db9a24..408ba486db7c1fdea3d0049379a1a56934e1f78d

---

From: Kazuho Oku <[email-masked]>
Date: Thu, 31 Oct 2019 22:24:51 -0700

Thanks! Applied in 408ba48.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3164#discussion_r341455087