Re: [quicwg/base-drafts] Specify IPv6 flow label for QUIC (#2348)

[Martin Thomson <[e-mail]>]

So the real problem here is that if we do have labels, we want to guarantee that we don't create linkability at the IP layer.  The costs for forwarding in the network seem manageable, and the load balancer is supposed to know what connection IDs are and use those for consistently routing.  Using the flow label for the first packet, assuming a stateful load balancer, as described in RFC 7098 seems fairly consistent with this.  The stateless processing is made worse by virtue of having to find the connection ID, so much of the benefit there is lost for a purely stateless load balancer.

BTW, I don't like this statement in 7098:

>    o  SSL and HTTP proxies, if present, should forward the flow label
      value towards the server.  This usually has no performance
      benefit, but it is consistent with the general model for the flow
      label described in RFC 6437.

That's only really going to benefit traffic analysis, which isn't a great outcome.  One advantage of terminating TLS is that there is some remixing and re-encryption of inbound and forwarded data.  In any case, simple 1:1 mappings across this sort of proxy aren't always feasible as the proxy tends to route requests and not connections.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2348#issuecomment-455948049