Subject: [quicwg/base-drafts] Mixing connection IDs is OK (#3870)

From: Martin Thomson <[email-masked]>
Date: Tue, 07 Jul 2020 23:36:19 -0700

This is a loosening of the recommendation regarding mixed connection IDs while coalescing.  This says that receivers shouldn&#39;t route individual packets to different connections if they are coalesced.  (I note that it would be enough to permit them to discard packets for different connections, but a recommendation to apply good sense is also good.)

This isn&#39;t as strong as might seem theoretically necessary, but we determined it to be OK.  We can only coalesce during the handshake, so linkability concerns are moot as addresses are assumed to be stable.  With linkability concerns addressed, there was no need to provide any strong requirement that stacks provide the same connection ID for every coalesced packet.

Closes #3800.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/3870

-- Commit Summary --

  * Mixing connection IDs is OK

-- File Changes --

    M draft-ietf-quic-transport.md (4)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/3870.patch
https://github.com/quicwg/base-drafts/pull/3870.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870

---

From: Martin Thomson <[email-masked]>
Date: Tue, 07 Jul 2020 23:36:38 -0700

Oops, this is something of a design change.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#issuecomment-655318793

---

From: Marten Seemann <[email-masked]>
Date: Tue, 07 Jul 2020 23:42:30 -0700

@marten-seemann approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#pullrequestreview-444452429

---

From: David Schinazi <[email-masked]>
Date: Wed, 08 Jul 2020 15:48:56 -0700

@DavidSchinazi approved this pull request.

I like this change. In our implementation, we use the first destination connection ID in a packet to route to a given connection and then the connection object is responsible for detecting the presence of coalesced packets and validating that they were meant for this connection.

However, shouldn't this be a MUST instead of a SHOULD? Since this failure mode is easy to detect, can't we mandate checking?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#pullrequestreview-445179552

---

From: Jana Iyengar <[email-masked]>
Date: Wed, 08 Jul 2020 16:26:56 -0700

@janaiyengar approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#pullrequestreview-445193826

---

From: Jana Iyengar <[email-masked]>
Date: Wed, 08 Jul 2020 16:27:53 -0700

@DavidSchinazi : Whether this is easy to detect or not depends on the implementation. I don't see a _need_ to mandate checking.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#issuecomment-655808733

---

From: David Schinazi <[email-masked]>
Date: Wed, 08 Jul 2020 16:51:31 -0700

@janaiyengar I don't see whether this is *needed* as the right metric. Our design so far has been to mandate compliance checks unless they're particularly hard or expensive.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#issuecomment-655815532

---

From: Martin Thomson <[email-masked]>
Date: Wed, 08 Jul 2020 18:08:00 -0700

This is not something we can guarantee in general as we don't protect the assembly of packets into datagrams.  If you feel strongly about that, please open an issue.  

FWIW, I think that most stacks will do this just fine, but I'm concerned that if start to build on top of mechanisms that aren't authenticated, we get unpredictable results.  Maybe QUICv2 can authenticate how packets are coalesced.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#issuecomment-655835809

---

From: David Schinazi <[email-masked]>
Date: Wed, 08 Jul 2020 18:12:18 -0700

Fair enough, I don't feel too strongly on this one. Either way, this PR makes the text better so please don't consider my comments as blocking it - I think we should land this.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#issuecomment-655837102

---

From: Mike Bishop <[email-masked]>
Date: Thu, 09 Jul 2020 12:23:30 -0700

@MikeBishop approved this pull request.

I don't see that forcing verification buys us anything.  Given that intermediaries can freely remix the packet/datagram boundaries, the only thing we could do for a violation is ignore the packet.  If you don't ignore the packet, then it will just get rejected as invalid anyway.

The failure mode might be having valid packets for two different connections in the same datagram, and the server processes both for their respective connections.  If they're two valid packets, that's... potentially not harmful, I suppose?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#pullrequestreview-445903526

---

From: ianswett <[email-masked]>
Date: Fri, 10 Jul 2020 11:28:51 -0700

@ianswett approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#pullrequestreview-446611069

---

From: Kazuho Oku <[email-masked]>
Date: Sun, 12 Jul 2020 20:53:33 -0700

@kazuho approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#pullrequestreview-446965810

---

From: Marten Seemann <[email-masked]>
Date: Sun, 12 Jul 2020 21:03:35 -0700

@marten-seemann requested changes on this pull request.

As I described in https://github.com/quicwg/base-drafts/issues/3800#issuecomment-657311225, I changed my mind on this PR. I don't think it's necessary to make this change.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#pullrequestreview-446968139

---

From: Christian Huitema <[email-masked]>
Date: Tue, 14 Jul 2020 16:48:26 -0700

@huitema requested changes on this pull request.

I do not agree. The connection-ID check is much easier to implement on clients than the connection check, which requires looking up and comparing connection contexts.

> @@ -3192,8 +3192,8 @@ packets at the same encryption level.
 
 Receivers MAY route based on the information in the first packet contained in a
 UDP datagram.  Senders MUST NOT coalesce QUIC packets for different connections
-into a single UDP datagram.  Receivers SHOULD ignore any subsequent packets with
-a different Destination Connection ID than the first packet in the datagram.
+into a single UDP datagram.  Receivers SHOULD ignore any subsequent packets for
+a different connection than the first packet in the datagram.

I do not agree with this change. It complicates packet parsing, for very little practical gain. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#pullrequestreview-448537042

---

From: Praveen Balasubramanian <[email-masked]>
Date: Wed, 15 Jul 2020 10:35:04 -0700

@pravb commented on this pull request.

I do not agree with this change. It's unnecessary complexity for no clear benefit. We should fix the sender text to say MUST NOT coalesce different connection IDs into a single datagram. If there are scenarios where this is needed let's revisit in QUIC v2.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#discussion_r455221737

---

From: Martin Thomson <[email-masked]>
Date: Wed, 29 Jul 2020 06:15:37 -0700

Closed #3870 via #3930.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3870#event-3598991349