Re: [quicwg/base-drafts] Mandate using a new connection ID on migration (#2413)

Mike Bishop <notifications@github.com> Wed, 06 February 2019 19:49 UTC

Date: Wed, 06 Feb 2019 11:49:17 -0800
From: Mike Bishop <notifications@github.com>
Reply-To: quicwg/base-drafts <reply+0166e4abd5fc15af438a32210be1ae22f328cdd099a6b8a992cf000000011872fc3d92a169ce183ba2c6@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/2413/461162070@github.com>
In-Reply-To: <quicwg/base-drafts/issues/2413@github.com>
References: <quicwg/base-drafts/issues/2413@github.com>
Subject: Re: [quicwg/base-drafts] Mandate using a new connection ID on migration (#2413)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5c5b3a3d50bd9_58823fa5748d45c4697898"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/h1k-VmMUq6r3MZULWcPovmPCXCw>

The problem with migrating with an empty CID is that the recipient can't identify which connection it should be considered for.  It's going to have to do trial decryption with the keys for all current 0LCID connections on that destination port if it wants to permit that.  (In fact, I'm fairly sure we previously had text that said if you couldn't match a packet to exactly one connection upon receipt, you had to drop it; that seems to have been removed.)  On a NAT rebinding, a server could say that if the IP matches and only the port has changed, it might still match a singular existing connection.

That's only safe if the server is using a unique port for each connection, which seems unlikely.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2413#issuecomment-461162070

[quicwg/base-drafts] Mandate using a new connecti… Martin Thomson
Re: [quicwg/base-drafts] Mandate using a new conn… Igor Lubashev
Re: [quicwg/base-drafts] Mandate using a new conn… erickinnear
Re: [quicwg/base-drafts] Mandate using a new conn… Martin Thomson
Re: [quicwg/base-drafts] Mandate using a new conn… Igor Lubashev
Re: [quicwg/base-drafts] Mandate using a new conn… David Schinazi
Re: [quicwg/base-drafts] Mandate using a new conn… MikkelFJ
Re: [quicwg/base-drafts] Mandate using a new conn… Mike Bishop
Re: [quicwg/base-drafts] Mandate using a new conn… MikkelFJ
Re: [quicwg/base-drafts] Mandate using a new conn… Martin Thomson
Re: [quicwg/base-drafts] Mandate using a new conn… Martin Thomson
Re: [quicwg/base-drafts] Mandate using a new conn… Martin Thomson
Re: [quicwg/base-drafts] Mandate using a new conn… Jana Iyengar
Re: [quicwg/base-drafts] Mandate using a new conn… Jana Iyengar
Re: [quicwg/base-drafts] Mandate using a new conn… Martin Thomson