Re: Greasing the QUIC Bit

[Paul Vixie <[e-mail]>]

On Thursday, 2 July 2020 13:18:59 UTC Brian Trammell (IETF) wrote:
> ...
> 
> I continue to fear that the demand for on-path discrimination of QUIC
> traffic will remain such that if:
> 
> - there is no intentional invariant for distinguishing QUIC traffic from
> non-QUIC traffic by arbitrary on-path devices; AND - there is a trivially
> deployable method for blocking QUIC traffic which will result in negligible
> end-to-end availability risk and low impact on quality of experience, i.e.
> that blocking will come at no cost to access networks that choose to do so
> (which given TCP fallback is indeed the case in the majority of networks,
> unless things have changed since I last looked)
> 
> then we remain at risk of a rapid reversal of fortune on deployment. Sorry,
> hadn't said that at a mic for about a year now, felt a need to repeat it
> for the record. :)
> 
> As this view is incapable of gaining consensus within this working group,
> I'm fully in support of this approach to greasing the QUIC bit: we should
> be intentional about our invariants, and back them up with running code.
> And this appears to be a perfectly reasonable way to do that.

among the SASE (secure access service edge), such as enterprise, home, and 
other privately operated networks, QUIC is going to face accidental reverse 
discrimination. UDP is privileged here, only permitted if it is recognizably 
permitted. if QUIC offers no way to be recognized, then the fortunes of its 
deployment will be moderate.

when i say privileged, i mean default-deny in both host-based firewalls and 
perimeter gateways. i hope to be able to use QUIC on such networks, but i 
won't do so if it's an all or nothing proposition-- allow any unknown traffic 
or disallow QUIC, means to me, disallow QUIC. my position will be typical 
among CISO's. if QUIC is intended only for public (ISP or mobile IP), then i 
withdraw my concern.

the QUIC bit isn't enough to hook onto, so greasing that doesn't hurt the SASE 
use case. but i think we'll all be better off if we don't have SASE networks 
using destination UDP port number as the hook for "allow this traffic".

see also:

https://techspective.net/2020/06/23/the-four-horsemen-of-sase-secure-access-service-edge/

-- 
Paul