Re: Unrecoverable loss pattern

[Martin Thomson <[e-mail]>]

Yes, this is a real issue.  It arises because the packet that would
normally trigger loss detection for the request packet (the ACK for
the Finished) never gets sent because the server believes the client
to be quiescent.  The server believes that because it discards the
cleartext packets that it receives.

Client sends ...., Finished, ACK, Y. Then Y is lost.  Server
acknowledges up to Finished, but this acknowledgment is lost. Client
detects loss of the Finished.  It does this on a timer, because if the
server was sending data, the client would receive the ACK for the
Finished and things would work out.

If the handshake wasn't special, the client would send Finished again
using the 1-RTT keys, and this wouldn't be a problem.  But in this
case it resends Finished in a new packet and the server throws that
away.  The client never does TLP or RTO for Y.  See
<https://quicwg.github.io/base-drafts/draft-ietf-quic-recovery.html#rfc.section.3.4.7.4>
for that algorithm.

The general case is a little worrying: as long as the Finished is
outstanding, the client will not repair loss from other packets (see
<https://quicwg.github.io/base-drafts/draft-ietf-quic-recovery.html#rfc.section.3.4.8>).

You might consider this failing to be a result of trying to compose
the various timers into a single alarm.  This wouldn't be a problem if
the RTO and TLP for ordinary packets proceeded as normal.  One extra
timer during the handshake isn't that much additional burden.  But
maybe there is a more elegant solution.

On Mon, Feb 26, 2018 at 12:30 PM, Marten Seemann
<[e-mail]> wrote:
> The problem is that the server will not open the unencrypted packet
> containing the retransmission of the FINISHED, since it already completed
> the handshake AND received ACKs for all its handshake packets. We *could*
> fix this problem by making the server accept unencrypted packets
> indefinitely, but this comes with a whole range of problems of
> man-on-the-side attacks.
>
> On Mon, Feb 26, 2018 at 9:20 AM Christian Huitema <[e-mail]>
> wrote:
>>
>> On 2/25/2018 4:58 PM, Marten Seemann wrote:
>>
>> @Nick: The server did get all handshake packets, please see 1. in my
>> description. It's the server's ACK for the FINISHED message that is lost,
>> not the FINISHED message itself.
>> @Martin: Yes, it is, but I don't think there's anything problematic about
>> the language in this paragraph. Since the server received ACKs for all the
>> handshake messages it sent, it makes sense to not open unencrypted packets
>> any more.
>>
>>
>> See https://github.com/quicwg/base-drafts/issues/829 and
>> https://github.com/quicwg/base-drafts/issues/1018 for  discussion of related
>> issues.
>>
>> Picoquic manages these issues by handling "ACK of ACK". Normally, it will
>> send ACK frames that acknowledge all packets received so far, potentially
>> with a long list of ACK ranges. So if an ACK is lost, the next ACK will
>> repeat the information that it carried. The list is only pruned when an "ACK
>> of ACK" is received.
>>
>> In your example, if the FINISHED message is not acknowledged, the client
>> will retransmit the stream zero data containing the FINISHED message in a
>> new Handshake packet. The server will have to send an ACK of that packet,
>> and the ACK range will also cover the previous packet. There is no problem
>> for sending that ACK. You cannot acknowledge a protected packet in a clear
>> text message, but nothing prevents you from acknowledging clear text packets
>> in protected messages.
>>
>>
>> -- Christian Huitema