Re: [quicwg/base-drafts] Long Header Packets and Routing Connection IDs (#2834)

[Nick Banks <[e-mail]>]

>All the packets that the client sends in response to server's packet contains a server-chosen CID.

>This is an excellent property.

@kazuho with the current way things are spec'ed, and assuming you do not use auth tags in the CIDs and that you do not try to decrypt the actual payload, when a stateless LB receives an Initial packet from the client, how exactly is it supposed to chose which backend server to send it to?

In other words, how do you differentiate the very first Initial packet from the client (using the client CID) vs a response Initial packet (using the server CID)?

> Besides, if you are fine with routing packets based on client-chosen CID, I'd assume that you'd also be fine with routing long header packets based on the 5-tuple.

As far as exposing attacks, existing (TCP/UDP) deployments already use hashing of the 5-tuple to route packets. Using similar logic (hash of CID+tuple) to route just initial QUIC packets doesn't expose any additional attack surface.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2834#issuecomment-505201750