Re: [quicwg/base-drafts] Stateless reset oracle defense (#1554)

[Kazuho Oku <[e-mail]>]

kazuho commented on this pull request.



> +packets for a given connection ID.  That is, the routing needs to ensure that a
+stateless reset is not generated unless the associated connection (as identified
+by the connection ID) cannot proceed.
+
+For endpoints that operate in clusters, instances that share a static key for
+stateless reset (see {{reset-token}}) MUST be arranged so that packets with a
+given connection ID always arrive at an instance that has connection state,
+unless that connection is no longer active.
+
+In the case of a cluster that uses dynamic load balancing, it's possible that a
+change in load balancer configuration could happen while an active instance
+retains connection state; even if an instance retains connection state, the
+change in routing and resulting stateless reset will result in the connection
+being terminated.  This is acceptable as long as the loss of connections during
+rebalancing is by design and not something that an external entity can
+influence.

I am not sure how the last sentence applies to the discussion in the paragraph.

If I understand correctly, the intent of the paragraph is to state that if there is no chance in the packet being routed to the correct server, it is logical to send a stateless reset rather than waiting for timeout. That is logical. However, the last sentence talks about frequency of rebalancing, which IMO is unrelated to whether if we send a reset or wait for timeout.

It seems to me that it might be a better idea to state here that, by using the rebalancing as an example, that sending stateless reset is preferable than waiting for timeout, and move the discussion about the frequency of rebalancing to somewhere else, since it is not an issue specific to QUIC having authenticated resets (TCP sharding using 5-tuple has the same issue).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1554#pullrequestreview-136871375