Re: [quicwg/base-drafts] Disable Migration field in SPA (#3898)

[Igor Lubashev <[e-mail]>]

@igorlord requested changes on this pull request.

We need to clarify what to do about source addresses when changing protocol families.

> @@ -2178,12 +2180,16 @@ before the handshake is confirmed, as defined in section 4.1.2 of {{QUIC-TLS}}.
 
 If the peer sent the disable_active_migration transport parameter, an endpoint
 also MUST NOT send packets (including probing packets; see {{probing}}) from a
-different local address to the address the peer used during the handshake. An
-endpoint that has sent this transport parameter, but detects that a peer has
-nonetheless migrated to a different remote address MUST either drop the incoming
-packets on that path without generating a stateless reset or proceed with path
-validation and allow the peer to migrate. Generating a stateless reset or
-closing the connection would allow third parties in the network to cause
+different local address to the address the peer used during the handshake. If
+the server sets the Disable Migration field in the preferred_address transport
+parameter, the client MUST NOT send packets from a different local address to
+the server's preferred address.

You may want to specify that when Disable Migration is set, to migrate to an SPA of a different address family, the client MUST (SHOULD?) use a source address belonging to the same network attachment interface as the handshake address.

> @@ -2178,12 +2180,16 @@ before the handshake is confirmed, as defined in section 4.1.2 of {{QUIC-TLS}}.
 
 If the peer sent the disable_active_migration transport parameter, an endpoint
 also MUST NOT send packets (including probing packets; see {{probing}}) from a
-different local address to the address the peer used during the handshake. An
-endpoint that has sent this transport parameter, but detects that a peer has
-nonetheless migrated to a different remote address MUST either drop the incoming
-packets on that path without generating a stateless reset or proceed with path
-validation and allow the peer to migrate. Generating a stateless reset or
-closing the connection would allow third parties in the network to cause
+different local address to the address the peer used during the handshake. If
+the server sets the Disable Migration field in the preferred_address transport
+parameter, the client MUST NOT send packets from a different local address to

I think we could replace MUST with SHOULD in regard to `disable_active_migration` and `Disable Migration`.  Nothing here is enforceable, since unintended migrations can always happen.  The effect is likely similar.

> @@ -5078,6 +5086,7 @@ Preferred Address {
   IPv4 Port (16),
   IPv6 Address (128),
   IPv6 Port (16),
+  Disable Migration (8),

We've had a proposal to make this flag per-address.  Need to land this discussion.  If we adopt the suggestion above about Disable Migration means for switching to a different protocol family, this becomes easier to reason about a per-family flag.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3898#pullrequestreview-447699048