Re: Is "Version Greasing" a new benfit or a new obstacle?

[Christian Huitema <[e-mail]>]

On 4/12/2019 8:57 AM, Ian Swett wrote:
>
> *From:* Praveen Balasubramanian
> *...*
>
> Version greasing will create problems for DDoS protection. The DDoS
> protection middlebox will have to treat all traffic with unknown
> version numbers as plain old QUIC and rate limit it. Any solution that
> requires per connection state to track version numbers doesn’t scale.
> Especially in the cloud scenario customers bring their own web servers
> so this makes any opt-out solution not good enough. So I do think this
> is an obstacle for many deployments.
>
Don't we have an example of middle-box ossification just there?

Praveen's example points to the perils of the "shortest path" approach
to middle-box design. Taking the shortest path means finding something
that works now, and once you have found it deploy it without worry about
consequences -- which very often include ossification. If the DDOS
protection box looks for "QUIC versions that it knows" and just rate
limits the other types of packets, then the box will by design prevent
deployment of versions that it does not know.

I assume that big organizations like Azure will update their protections
once a new version is out, but the experience shows that many other
organizations don't. And even when they do, the focus on published
versions will block experimenting with new versions, not to mention
interfering with other features like connection migration. I take
Praveen's example as an argument why we should in fact standardize
version greasing, precisely to avoid this "shortest path middle-box
design".

In the case of DDOS protection, I will point out that DDOS protection
also needs to work with short header packets, which do not carry any
version number. In order to avoid DDOS by short header packets, the
boxes have to be able to distinguish between packets that belong to
authorized connections and packets that don't. And if you do that, then
you don't really need to look at the version numbers, you can simply
rely on the invariants.

-- Christian Huitema