Subject: Re: [quicwg/base-drafts] 5tuple routing (#3536)

From: Mike Bishop <[email-masked]>
Date: Wed, 01 Apr 2020 07:31:16 -0700

@MikeBishop approved this pull request.

> @@ -1156,6 +1156,34 @@ SHOULD ignore any such packets.
 
 Servers MUST drop incoming packets under all other circumstances.
 
+### Considerations for 5-tuple routing architectures
+
+QUIC endpoints can be deployed behind a 5-tuple based routing architecture that
+delivers packets based on both the source and destination IP addresses and
+ports. When routing depends on addresses that the endpoint does not control,
+changes to the IP address or port of peers could result in packets being routed
+to a different server. The following actions could mitigate or resolve
+operational and security issues in this case:
+
+* Endpoints can use an out-of-band mechanism to deliver packets to the correct
+destination or transfer state from the original destination.
+
+* A server can request that a connection be migrated to an address that is
+unique using the preferred_address transport parameter. For example, the initial

It seems like the property we're intending to talk about is not uniqueness across clients, but an address that reaches that server specifically rather than a group of servers.  (Or reaches a smaller group of servers capable of internal routing based on CID, which amounts to the same thing.)  Perhaps the right way to express this is "an address that does not rely on 5-tuple routing"?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-385642642

---

From: Martin Thomson <[email-masked]>
Date: Wed, 01 Apr 2020 15:58:47 -0700

@martinthomson commented on this pull request.

 

That is imprecise.  A connection ID means that you don't rely on 5-tuple routing.  The relevant point is that the destination address of packets is unique - at least for the time that the connection is active.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#discussion_r401958312

---

From: martinduke <[email-masked]>
Date: Wed, 01 Apr 2020 17:06:12 -0700

@martinduke commented on this pull request.

 

I think we settled on "unique". resolving...

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#discussion_r401979756

---

From: martinduke <[email-masked]>
Date: Wed, 01 Apr 2020 17:08:02 -0700

So @martinthomson do you want new or revised language here, or will the other issue address the linkability stuff? I would like to close this out if it's good enough.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#issuecomment-607549284

---

From: Martin Thomson <[email-masked]>
Date: Wed, 01 Apr 2020 18:01:30 -0700

Given how hard this has been to get right, I want @janaiyengar to take a look.  But I'm happy with this.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#issuecomment-607562699

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 01 Apr 2020 18:18:14 -0700

@kazuho approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-386051363

---

From: Martin Thomson <[email-masked]>
Date: Sun, 19 Apr 2020 22:29:47 -0700

A reminder for @janaiyengar to either take a look or say that this is OK to proceed without another review.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#issuecomment-616319734

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 28 Apr 2020 15:59:19 -0700

@janaiyengar commented on this pull request.

editorial suggestions

```suggestion
A server farm could be deployed behind a simple load balancer that routes
packets based on source and destination IP addresses and ports. Changes to
the IP address or port of a peer could result in packets being routed by the load
balancer to a different server. Such a server deployment could use one of the
following methods to for connection continuity when a client's address changes.
```

 

```suggestion
### Considerations for simple load balancers
```

```suggestion
* Servers could use an out-of-band mechanism to forward packets or connection
state to the correct endpoint.
```

+unique using the preferred_address transport parameter. For example, the initial
+address may route to a 5-tuple based load balancer, and the preferred address
+could indicate a separate server address that does not require the use of the
+client address for routing. Note that clients could choose not to use the
+preferred address.

```suggestion
* If the server deployment can use other non-load-balanced server IP
addresses or ports than the one that the client is initiating connections on,
servers could use the preferred_address transport parameter to request
that clients move to these server addresses. Note that clients could choose
not to use the preferred address.
```

> +If a server does not implement one of the solutions above, it SHOULD send the
+disable_active_migration transport parameter to inform the client that any
+address change is likely to terminate the connection.

```suggestion
If a server behind such a load balancer does not implement a solution to
maintain connection continuity SHOULD disallow connection migration
via the disable_active_migration transport parameter.
```

> +Regardless of other mitigations, 5-tuple routing introduces new possibilities
+to create a stateless reset oracle. An attacker could tweak the source address
+or port of a packet to direct it to a different server and thus obtain the
+stateless reset token for a connection ID. Endpoints should take additional
+precautions in accordance with {{reset-oracle}}.

```suggestion
Server deployments that use such load balancing might still allow for
creation of a stateless reset oracle. Servers should take additional
precautions in accordance with {{reset-oracle}}.
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-402243394

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 28 Apr 2020 16:01:25 -0700

@janaiyengar pushed 1 commit.

5e6c5b4750c8300f625ae9539ca65f27a5824e0f  Apply suggestions from code review

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536/files/88a71208e9d4db9fcd6f4724bc1476e1f604a4bf..5e6c5b4750c8300f625ae9539ca65f27a5824e0f

---

From: ianswett <[email-masked]>
Date: Tue, 28 Apr 2020 16:07:47 -0700

@ianswett commented on this pull request.

Some more editorial comments.

> @@ -1156,6 +1156,30 @@ SHOULD ignore any such packets.

+### Considerations for simple load balancers
+
+A server farm could be deployed behind a simple load balancer that routes

```suggestion
Servers could be deployed behind a simple load balancer that routes
```

> +* Servers could use an out-of-band mechanism to forward packets or connection
+state to the correct endpoint.

```suggestion
* Servers could use an out-of-band mechanism to forward packets to the correct server based
on Connection ID.
```

> +If a server behind such a load balancer does not implement a solution to
+maintain connection continuity SHOULD disallow connection migration
+via the disable_active_migration transport parameter.

```suggestion
Servers behind load balancers that do not implement a solution to
maintain connection continuity SHOULD disallow connection migration
via the disable_active_migration transport parameter.
```

> +following methods to for connection continuity when a client's address changes.
+
+* Servers could use an out-of-band mechanism to forward packets or connection
+state to the correct endpoint.
+
+* If the server deployment can use other non-load-balanced server IP
+addresses or ports than the one that the client is initiating connections on,
+servers could use the preferred_address transport parameter to request
+that clients move to these server addresses. Note that clients could choose
+not to use the preferred address.
+
+If a server behind such a load balancer does not implement a solution to
+maintain connection continuity SHOULD disallow connection migration
+via the disable_active_migration transport parameter.
+
+Server deployments that use such load balancing might still allow for

```suggestion
Server deployments that use such load balancing might allow for
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-402271809

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 28 Apr 2020 16:10:22 -0700

```suggestion
that clients move connections to these dedicated addresses. Note that clients could
choose not to use the preferred address.
```

> +A server farm could be deployed behind a simple load balancer that routes
+packets based on source and destination IP addresses and ports. Changes to
+the IP address or port of a peer could result in packets being routed by the load
+balancer to a different server. Such a server deployment could use one of the
+following methods to for connection continuity when a client's address changes.

```suggestion
A server deployment could load balance among servers using simply source and
destination IP addresses and ports. Changes to the client's IP address or port of
could result in packets being forwarded to the wrong server. Such a server
deployment could use one of the following methods to for connection continuity
when a client's address changes.
```

```suggestion
* If servers can use other dedicated server IP addresses or ports than
the one that the client is initiating connections to, they could use the
preferred_address transport parameter to request
```

+creation of a stateless reset oracle. Servers should take additional

```suggestion
A server in a deployment that does not implement a solution to
maintain connection continuity during connection migration
SHOULD disallow it via the disable_active_migration transport
parameter.

Server deployments that use such load balancing might still allow for
creation of a stateless reset oracle, and should therefore follow the
guidelines in {{reset-oracle}}.
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-402271445

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 28 Apr 2020 16:11:32 -0700

e06a5420b9870f9cfe6450f1f1e2e655b76e3861  Apply suggestions from code review

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536/files/5e6c5b4750c8300f625ae9539ca65f27a5824e0f..e06a5420b9870f9cfe6450f1f1e2e655b76e3861

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 28 Apr 2020 16:12:04 -0700

1c5b3a9454c5b3e6d183e93d57ce5ce980fcd604  Update draft-ietf-quic-transport.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536/files/e06a5420b9870f9cfe6450f1f1e2e655b76e3861..1c5b3a9454c5b3e6d183e93d57ce5ce980fcd604

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 28 Apr 2020 16:12:16 -0700

0b4044e328abb21d5d1fb5055209721b7daf4db5  Update draft-ietf-quic-transport.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536/files/1c5b3a9454c5b3e6d183e93d57ce5ce980fcd604..0b4044e328abb21d5d1fb5055209721b7daf4db5

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 28 Apr 2020 16:12:55 -0700

> +* Servers could use an out-of-band mechanism to forward packets to the correct server based
+on Connection ID.

```suggestion
* Servers could use an out-of-band mechanism to forward packets to the correct
server based on Connection ID.
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-402275396

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 28 Apr 2020 16:12:59 -0700

19e9d5c5cdd9e50d524c6c4fc7c9ef77dce667b8  Update draft-ietf-quic-transport.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536/files/0b4044e328abb21d5d1fb5055209721b7daf4db5..19e9d5c5cdd9e50d524c6c4fc7c9ef77dce667b8

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 28 Apr 2020 16:13:22 -0700

> +preferred_address transport parameter to request
+that clients move connections to these dedicated addresses. Note that clients could
+choose not to use the preferred address.

```suggestion
preferred_address transport parameter to request that clients move
connections to these dedicated addresses. Note that clients could
choose not to use the preferred address.
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-402275550

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 28 Apr 2020 16:13:24 -0700

729fcb04e76d59f508d2c853d270065ded6e02cd  Update draft-ietf-quic-transport.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536/files/19e9d5c5cdd9e50d524c6c4fc7c9ef77dce667b8..729fcb04e76d59f508d2c853d270065ded6e02cd

---

From: ianswett <[email-masked]>
Date: Tue, 28 Apr 2020 16:26:15 -0700

> @@ -1156,6 +1156,31 @@ SHOULD ignore any such packets.

```suggestion
### Considerations for Simple Load Balancers
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-402280652

---

From: ianswett <[email-masked]>
Date: Tue, 28 Apr 2020 16:26:37 -0700

+### Considerations for simple load balancers
+
+A server deployment could load balance among servers using simply source and

```suggestion
A deployment could load balance among servers using simply source and
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-402280789

---

From: ianswett <[email-masked]>
Date: Tue, 28 Apr 2020 16:27:53 -0700

+### Considerations for simple load balancers
+
+A server deployment could load balance among servers using simply source and
+destination IP addresses and ports. Changes to the client's IP address or port of

```suggestion
destination IP addresses and ports. Changes to the client's IP address or port
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-402281266

---

From: ianswett <[email-masked]>
Date: Tue, 28 Apr 2020 16:27:57 -0700

@ianswett pushed 1 commit.

6567ba811900207808bd427f892ec12de5adf32b  Update draft-ietf-quic-transport.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536/files/729fcb04e76d59f508d2c853d270065ded6e02cd..6567ba811900207808bd427f892ec12de5adf32b

---

From: ianswett <[email-masked]>
Date: Tue, 28 Apr 2020 16:28:31 -0700

+### Considerations for simple load balancers
+
+A server deployment could load balance among servers using simply source and
+destination IP addresses and ports. Changes to the client's IP address or port
+could result in packets being forwarded to the wrong server. Such a server
+deployment could use one of the following methods to for connection continuity

```suggestion
deployment could use one of the following methods for connection continuity
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-402281499

---

From: ianswett <[email-masked]>
Date: Tue, 28 Apr 2020 16:28:35 -0700

1368ccebe589a4088b5e86a579d1d4b5818a002d  Update draft-ietf-quic-transport.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536/files/6567ba811900207808bd427f892ec12de5adf32b..1368ccebe589a4088b5e86a579d1d4b5818a002d

---

From: ianswett <[email-masked]>
Date: Tue, 28 Apr 2020 16:29:38 -0700

+### Considerations for simple load balancers
+
+A server deployment could load balance among servers using simply source and
+destination IP addresses and ports. Changes to the client's IP address or port
+could result in packets being forwarded to the wrong server. Such a server
+deployment could use one of the following methods for connection continuity
+when a client's address changes.
+
+* Servers could use an out-of-band mechanism to forward packets to the correct
+server based on Connection ID.
+
+* If servers can use other dedicated server IP addresses or ports than
+the one that the client is initiating connections to, they could use the

```suggestion
the one that the client initially connects to, they could use the
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-402281878

---

From: ianswett <[email-masked]>
Date: Tue, 28 Apr 2020 16:30:24 -0700

@ianswett approved this pull request.

Some more suggestions, but overall this LG

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-402282136

---

From: Martin Thomson <[email-masked]>
Date: Tue, 28 Apr 2020 18:44:24 -0700

@martinthomson pushed 1 commit.

3b25faf7fc35bcabc7e67569b94ac7901aefedd8  Ian's suggestions

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536/files/1368ccebe589a4088b5e86a579d1d4b5818a002d..3b25faf7fc35bcabc7e67569b94ac7901aefedd8

---

From: Martin Thomson <[email-masked]>
Date: Tue, 28 Apr 2020 18:44:54 -0700

I'm sure that this is now basically unrecognizable...

 

```suggestion

+the one that the client is initiating connections to, they could use the
+preferred_address transport parameter to request that clients move
+connections to these dedicated addresses. Note that clients could
+choose not to use the preferred address.

```suggestion
* If servers can use a dedicated server IP address or port, other than the one
that the client is initially connects to, they could use the preferred_address
transport parameter to request that clients move connections to a dedicated
address. Note that clients could choose not to use the preferred address.
```

+deployment could use one of the following methods for connection continuity
+when a client's address changes.
+
+* Servers could use an out-of-band mechanism to forward packets to the correct
+server based on Connection ID.
+
+* If servers can use other dedicated server IP addresses or ports than
+the one that the client is initiating connections to, they could use the
+preferred_address transport parameter to request that clients move
+connections to these dedicated addresses. Note that clients could
+choose not to use the preferred address.
+
+A server in a deployment that does not implement a solution to
+maintain connection continuity during connection migration
+SHOULD disallow it via the disable_active_migration transport

```suggestion
SHOULD disallow migration using the disable_active_migration transport
```

> +Server deployments that use such load balancing might allow for
+creation of a stateless reset oracle, and should therefore follow the
+guidelines in {{reset-oracle}}.

Might as well just reiterate the existing requirement instead:

```suggestion
Server deployments that use this simple form of load balancing MUST avoid the
creation of a stateless reset oracle; see {{reset-oracle}}.
```

Fewer words, too.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-402270209

---

From: Mike Bishop <[email-masked]>
Date: Wed, 29 Apr 2020 08:55:39 -0700

Isn't the whole point of this section that the address/port initially used by the client _isn't_ dedicated to this particular server?  It seems like the entire "other than... connects to" phrase is unnecessary.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-402793670

---

From: martinduke <[email-masked]>
Date: Wed, 29 Apr 2020 10:51:03 -0700

outdated, resolving

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#discussion_r417501024

---

From: martinduke <[email-masked]>
Date: Wed, 29 Apr 2020 10:51:31 -0700

@martinduke pushed 1 commit.

36cac20525c1aefd0c6de9c004866c47261e30a1  Update draft-ietf-quic-transport.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536/files/3b25faf7fc35bcabc7e67569b94ac7901aefedd8..36cac20525c1aefd0c6de9c004866c47261e30a1

---

From: martinduke <[email-masked]>
Date: Wed, 29 Apr 2020 10:52:01 -0700

601c8fe1cd1f0dc4c9a4c35c386b566c7a989a89  Update draft-ietf-quic-transport.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536/files/36cac20525c1aefd0c6de9c004866c47261e30a1..601c8fe1cd1f0dc4c9a4c35c386b566c7a989a89

---

From: martinduke <[email-masked]>
Date: Wed, 29 Apr 2020 10:52:37 -0700

743702ca376c3ac2354a27820d75101111cfc857  Update draft-ietf-quic-transport.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536/files/601c8fe1cd1f0dc4c9a4c35c386b566c7a989a89..743702ca376c3ac2354a27820d75101111cfc857

---

From: Martin Thomson <[email-masked]>
Date: Wed, 29 Apr 2020 16:52:08 -0700

Merged #3536 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#event-3286946181

---

From: Martin Thomson <[email-masked]>
Date: Wed, 29 Apr 2020 16:52:32 -0700

I could not stand leaving this unmerged any longer.  Anyone with more comments can make a new PR.  Thanks to everyone who helped out here.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#issuecomment-621529241