Re: [quicwg/base-drafts] TLS application data isn't possible (#3043)

[Martin Thomson <[e-mail]>]

martinthomson commented on this pull request.



>  
 QUIC takes the unprotected content of TLS handshake records as the content of
 CRYPTO frames. TLS record protection is not used by QUIC. QUIC assembles
 CRYPTO frames into QUIC packets, which are protected using QUIC packet
 protection.
 
+QUIC is only capable of conveying TLS handshake records in CRYPTO frames.  TLS
+alerts are turned into QUIC CONNECTION_CLOSE error codes; see {{tls-errors}}.
+TLS application data and other message types cannot be carried by QUIC at any
+encryption level and can be treated as an error if they are received from the

I'll take Kazuho's "is an error" to avoid triggering the usual "treat X as an error of type" thinking that goes along with generating CONNECTION_CLOSE.  This is just wrong.

To Marten's point about how stacks can do this - I don't think that we generate any application_data records in our stack, but we certainly have assertions in place in case we get some.  If someone accidentally writes to the TLS socket, then we'll at catch that at the earliest possible moment.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3043#discussion_r325451959