Re: [DNSOP] Benjamin Kaduk's Discuss on draft-ietf-dnsop-session-signal-15: (with DISCUSS and COMMENT)

[Benjamin Kaduk <[e-mail]>]

Hi Ted,

On Thu, Sep 27, 2018 at 01:03:21AM -0400, Ted Lemon wrote:
> On Sep 27, 2018, at 12:55 AM, Ted Lemon <[e-mail]> wrote:
> > Yup.   Sorry about that.   I just submitted a new version that I hope addresses this request.
> 
> There's a mistake in the update—while I was working on the new text, I added a caveat about implicit sessions, but didn't notice that that had weakened the requirements on the client.   I've addressed this with the following change, but will wait on your and Mirja's responses before resubmitting:
> 
> -   If a server receives a Fast Open message containing a DSO message
> -   whose primary TLV is not permitted to appear in a Fast Open message,
> -   the server MUST forcible abort the connection.  If a client receives
> -   a Fast Open message containing any DSO message, and there is no
> -   implicit DSO session, the client MUST forcibly abort the connection.
> -   If a server or client receives a Fast Open message that is not a TLS
> -   1.3 message, it MUST forcibly abort the connection.
> +   If a client or server receives a Fast Open message containing a DSO
> +   message whose primary TLV is not permitted to appear in a Fast Open
> +   message, the server MUST forcible abort the connection.  If a client
> +   receives a Fast Open message containing any DSO message, and there is
> +   no implicit DSO session, the client MUST forcibly abort the
> +   connection.  If a server or client receives a Fast Open message that
> +   is not a TLS 1.3 message, it MUST forcibly abort the connection.

The -16 (plus this) look great; exactly what I was looking for.  I'll go
clear my Discuss in the datatracker.

But just to double-check my understanding: the idea is that the TCP Fast
Open payloads will only be used when TLS 1.3 is in use, and some be
something like (client's first handshake flight + early data) and (server's
first handshake flight + 0.5-RTT data), with the DSO operations being in
the early data and 0.5-RTT data records' payloads?

Also, I don't remember if IANA likes to keep columns like our "Fast Open"
one blank for unassigned/reserved ranges.  But presumably they will tell
you :)

Thanks again,

Benjamin