Re: [quicwg/base-drafts] How to reject a connection attempt (#3690)

Kazuho Oku <> Mon, 25 May 2020 00:32 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 12FF53A0E65 for <>; Sun, 24 May 2020 17:32:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.483
X-Spam-Status: No, score=-1.483 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id izx3AJIa88Eb for <>; Sun, 24 May 2020 17:32:23 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id A4BBC3A0E60 for <>; Sun, 24 May 2020 17:32:23 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 3020E6E0911 for <>; Sun, 24 May 2020 17:32:22 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=pf2014; t=1590366742; bh=ijjAhXz/HsomKoUVpUb3OY4xFnW3HlFSDM09rsNqiR4=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=HOCSQYOKv1qBQPhadCzpb4eXzAGA7jKeusv2b3lVSpvA3nyrwq8vQJUh6LgM3D9VT TJg2PnF81VAtca1t6H3AxCjDgZWrtdUaH1YYkhbeaHyxQnNyGpnT+EM+giRXkvEczl 05h3JSpvtlSgibIVHHmnRWkbxJdlhWsPNdHDUgww=
Date: Sun, 24 May 2020 17:32:22 -0700
From: Kazuho Oku <>
Reply-To: quicwg/base-drafts <>
To: quicwg/base-drafts <>
Cc: Subscribed <>
Message-ID: <quicwg/base-drafts/issues/3690/>
In-Reply-To: <quicwg/base-drafts/issues/>
References: <quicwg/base-drafts/issues/>
Subject: Re: [quicwg/base-drafts] How to reject a connection attempt (#3690)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5ecb121621527_6f1e3fef058cd960661442"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: kazuho
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
Archived-At: <>
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 25 May 2020 00:32:26 -0000

As a way of moving forward, I'd propose renaming SERVER_BUSY to CONNECTION_REFUSED, with no recommendation on how the client should react to that.

The rationale behind providing no recommendation is as stated above. QUIC needs to be strong against MITM attacks, at least as TLS over TCP is. TLS over TCP does not have an error code that tells the client to refrain from retrying for some amount of time. To achieve parity, we cannot have that. AFAIK, our experience with HTTPS tells us that there is no need for such an error code.

The rationale behind the renaming is that at the moment we do not have a generic error code for refusing connections, even though we have SERVER_BUSY, which indicates a specific reason of refusing a connection. Therefore, we need CONNECTION_REFUSED. We can rename SERVER_BUSY to CONNECTION_REFUSED. SERVER_BUSY does not need to be preserved, since, as stated, the client behavior cannot vary depending on an unauthenticated error code.


You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub: