Subject: [quicwg/base-drafts] Transport Draft should opine about 5-tuple based load balancing (#3500)

From: Ryan Hamilton <[email-masked]>
Date: Wed, 04 Mar 2020 12:38:24 -0800

The transport draft talks about QUIC being resilient to NAT rebindings. However, if a QUIC server is behind an L3 load balancer which simply routes based on 5-tuple, then connections to this server will (likely) not survive rebinding. I couldn't find any language which addressed whether such a deployment was "OK" or not. I think that since this load balance does not support NAT binding resilience, it is implicitly "bad" according to the draft, but others might disagree. In any case, I think there should be text to address this.

Note, if the server advertised a preferred_address which routed around the load balancer, and if clients were *required* to use this address, then that could obviously work. But preferred_address support is a SHOULD, not a MUST.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3500

---

From: Martin Thomson <[email-masked]>
Date: Wed, 04 Mar 2020 14:55:49 -0800

We did discuss this issue. Use of empty connection IDs and demultiplexing based on source addresses.  The conclusion there was that this was OK: people could do that, as long as it was clear that what they were getting was not different than TCP.  That is, we made it clear that if you don't use the identifiers that you control (your addresses, the connection ID), then you accept that you can't handle migration at all and connections will drop (well, unless you do something like trial decryption, which has some obvious scaling issues).

The outcome of that discussion was captured in #2868 

Assuming that Ryan finds this answer satisfactory (and I haven't missed anything), then I suggest we just close this as a duplicate of #2844.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3500#issuecomment-594913666

---

From: martinduke <[email-masked]>
Date: Fri, 06 Mar 2020 10:50:35 -0800

I don't think this captures Ryan's concern: when the server is using a non-zero CID and also is behind 4-tuple routing. I think he's looking for a section of text to coherently describe what you have to do here:

- send either disable_migration or preferred_address; or
- forward packets between servers; or
- either don't use a common stateless_reset key, or put client address/port in the reset token.

This is sort of ops-drafty but there real requirements on servers to behave in a secure way. I think someone with full command of the transport draft would figure this out, but it is not clearly stated anywhere.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3500#issuecomment-595908046

---

From: Ryan Hamilton <[email-masked]>
Date: Fri, 06 Mar 2020 14:59:33 -0800

I agree with Martin Duke and the language he suggests makes sense to me.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3500#issuecomment-596000377

---

From: ianswett <[email-masked]>
Date: Sat, 07 Mar 2020 02:50:48 -0800

This does feel a bit ops-drafty to me, but I'd be happy to review a PR.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3500#issuecomment-596074722