Re: Never fragment: getting PMTU info transmitted reliably

[Christian Huitema <[e-mail]>]

On 1/17/2019 5:12 AM, Tom Herbert wrote:

> Using flow label or transport layer information is only best effort
> for persistence. Intermediate devices are allowed to change devices
> flow labels, NAT evictions of UDP may change the client side ports and
> address mid-flow. QUIC is interesting since it doesn't use the IP
> addresses or ports for identifying connections. That conceptually
> allows a client to purposely randomize both the source address and the
> port on every packet to make it hard for intermediate devices to
> correlate packets as belonging to the same flow (for security).


That's not what the current QUIC spec says. The nodes monitor the
addresses and ports from which their peer is sending data. A change of
source address is identified as a potential NAT rebinding, or migration.
It triggers a series of address validation probes, and then migration of
the session to that new address if it is validated. Changing address on
each packet would be some kind of attack against this mechanism. (See
section 8 of the QUIc transport spec,
https://quicwg.org/base-drafts/draft-ietf-quic-transport.html#address-validation).


-- Christian Huitema