Re: [quicwg/base-drafts] HTTP/3 references QUIC Stream IDs directly, allowing illegal references (#3273)

[Kazuho Oku <[e-mail]>]

@martinthomson I'm not sure if the logic is correct. It is my understanding that the server need to set GOAWAY.stream_id to the largest request stream ID it has processed, __added by 4__.

This is because the rules are:
* The GOAWAY frame indicates that client-initiated requests on lower stream IDs were or might be processed in this connection, while requests on the indicated stream ID and greater were rejected ([section 5.2](https://quicwg.org/base-drafts/draft-ietf-quic-http.html#name-connection-shutdown)).
* It carries a QUIC Stream ID for a client-initiated bidirectional stream encoded as a variable-length integer ([section 7.2.6](https://quicwg.org/base-drafts/draft-ietf-quic-http.html#name-goaway)).

@LPardue My point is that the specification requires a server to send an stream ID it has never seen, when there are no requests inflight.

I thought that it would be good to use as an example the case where no requests have ever been sent, and that the spec has to call out what should happen in that particular case is a leak.

But that might not have been the best example. Maybe I should have given the example when one request is exchanged then the server idle-timeouts. In such case, GOAWAY.stream_id is expected to be 4, which is a stream ID that the server has never seen.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3273#issuecomment-562389672