Re: [quicwg/base-drafts] What needs to be checked for address validation (#3327)

[Kazuho Oku <[e-mail]>]

kazuho commented on this pull request.



> @@ -1829,10 +1829,21 @@ tokens that would be accepted by the server.  Only the server requires access to
 the integrity protection key for tokens.
 
 There is no need for a single well-defined format for the token because the
-server that generates the token also consumes it.  A token could include
-information about the claimed client address (IP and port), a timestamp, and any
-other supplementary information the server will need to validate the token in
-the future.
+server that generates the token also consumes it.  Tokens sent in Retry packets
+SHOULD include information that allows the server to verify that the source IP
+address and port in client packets remains constant.
+
+Servers might use tokens from NEW_TOKEN in deciding not to send a Retry packet,
+even if the client address has changed.  A token that was provided in
+NEW_TOKEN cannot be used for address validation if the client address is not the
+same, though servers MAY allow for the possibility of changes arising from new
+mappings at a NAT.

Thank you for the response. To me it seems that what we are actually looking for is an upper-case SHOULD that limits the scope of NEW_TOKEN tokens to one IP address. IMO that is the basis that we need to state. In addition, we can talk about when the scope can be wider, but that is less important.

I am not sure where the upper-case SHOULD should go into. It could be this section or [section 8.1.3](https://quicwg.org/base-drafts/draft-ietf-quic-transport.html#name-address-validation-for-futu). But assuming that it is the former, maybe we can replace this paragraph with something as simple as: "Tokens sent in NEW_TOKEN frames SHOULD include information that allows the server to verify if the client address is stable."

WDYT?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3327#discussion_r378005184