Resent-Date: Wed, 10 Jul 2024 01:18:57 +0000
Resent-Message-Id: <E1sRLyz-00EhC7-1e@mab.w3.org>
Received-SPF: pass (pan.w3.org: domain of apple.com designates 17.32.222.22 as permitted sender) client-ip=17.32.222.22; envelope-from=tpauly@apple.com; helo=ma-mailsvcp-mx-lapp01.apple.com;
Content-type: text/plain; charset=utf-8
MIME-version: 1.0 (Mac OS X Mail 16.0 \(3774.500.171.1.1\))
From: Tommy Pauly <tpauly@apple.com>
In-reply-to: <7e87de98-6b21-433f-a56f-456557c64a86@betaapp.fastmail.com>
Date: Tue, 09 Jul 2024 18:18:32 -0700
Cc: HTTP Working Group <ietf-http-wg@w3.org>
Content-transfer-encoding: quoted-printable
Message-id: <EB88DA6B-0691-4A0D-93A4-8CE23472E9DC@apple.com>
References:
 <CAPDSy+5UU=GSFWTdrkHW7RXNL8pr5KWtLfp8zjExsZvvGczfEw@mail.gmail.com>
 <7e87de98-6b21-433f-a56f-456557c64a86@betaapp.fastmail.com>
To: Martin Thomson <mt@lowentropy.net>
Subject: Re: Proposal: a new WRAP UP capsule
Archived-At: <https://www.w3.org/mid/EB88DA6B-0691-4A0D-93A4-8CE23472E9DC@apple.com>
Resent-From: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list



> On Jul 9, 2024, at 6:10=E2=80=AFPM, Martin Thomson <mt@lowentropy.net> =
wrote:
>=20
> Hi David,
>=20
> I think that this is reasonable - if your goal is to suggest that =
clients terminate a single CONNECT flow, rather than the entire =
connection.  This could also be achieved with GOAWAY, but it will affect =
multiple flows.  The draft doesn't say this, so maybe I'm missing =
something important.
>=20
> How common is it to establish multiple flows through a single proxy?  =
That might depend on use case (CONNECT-IP might be more profligate than =
CONNECT-UDP, say).

I think you'd generally see the most for CONNECT-TCP and CONNECT-UDP, =
when you=E2=80=99re proxying an application like a web browser. =
CONNECT-IP would generally be much more limited, and in some cases just =
be a big VPN tunnel.

Tommy

>=20
> Cheers,
> Martin
>=20
> On Sat, Jul 6, 2024, at 08:29, David Schinazi wrote:
>> Hi HTTP enthusiasts,
>>=20
>> Over in MASQUE land, as we're deploying our two-hop proxies, we =
decided=20
>> we needed to put a cap on how many bytes we'd allow per=20
>> token-authenticated connect-udp tunnel. Enforcing a hard limit is =
easy,=20
>> but the issue is that if the proxy aborts the tunnel halfway through,=20=

>> the web browser could be halfway through a proxied request. Since the=20=

>> browser doesn't know if the half-finished request was acted on or =
not,=20
>> it can't retry it, so it has to surface the error to the user. =
Instead,=20
>> we want the proxy to be able to warn the browser that this will =
happen=20
>> soon, so that the browser can establish a new tunnel with a new =
token,=20
>> and start sending new requests there. Conceptually this is a little=20=

>> like GOAWAY, but instead of "please wrap up this connection", it's=20
>> "please wrap up this tunnel stream". It uses capsules, since this is =
a=20
>> message from proxy to client. Here's a draft with diagrams:
>>=20
>> https://datatracker.ietf.org/doc/draft-schinazi-httpbis-wrap-up/
>> =
https://davidschinazi.github.io/draft-schinazi-httpbis-wrap-up/draft-schin=
azi-httpbis-wrap-up.html
>>=20
>> I'd love to hear your thoughts.
>>=20
>> Thanks,
>> David
>=20