Re: [TLS] Connection ID Draft

[Simon Bernard <[e-mail]>]

This makes me think about if this is feasible/desirable to use 
connection id to do load balancing.

I think about use cases where you have a cluster of server behind only 
one IP address. Often traffic will be load balanced by IP.
But with UDP and Nat environment, the IP can change.

Thx to CID, if client is redirected to the same server in the cluster, 
even if its IP has changed it will be able to communicate without new 
handshake.
But if its IP has changed there is little chance than load balancer will 
balance it on the same server and so new handshake is needed. (unless 
server share their connection state)

Any thought about that ?


Le 17/10/2017 à 23:35, Martin Thomson a écrit :
> On Tue, Oct 17, 2017 at 9:26 PM, Fossati, Thomas (Nokia -
> GB/Cambridge, UK) <[e-mail]> wrote:
>> The following case (NAT box reboot) is problematic:
>>
>> 1. Application '1' on host A (A.1) uses DTLS+CID with application '1' on
>>     host B (B.1);
>> 2. Application '2' on host A (A.2) uses plain-old DTLS with B.1;
>> 3. The NAT box reboots (all previous 5-tuple mappings are lost);
>> 4. B.1 receives a record from A.1 (whose 5-tuple has changed in the
>>     meanwhile);
>>
>> How is B.1 supposed to correctly interpret the bytes starting at offset
>> +11?  (For what it knows, it could be CID from A.1 or the length field
>> from A.2.)
> I don't think that this is a problem.
>
> connection = five_tuples.lookup(packet.five_tuple)
> if (!connection) {
>    connection = connection_ids.lookup(packet[connection_id_offset:connection_id_offset+connection_id_length])
> }
> if (!connection) {
>    // is this a ClientHello?  otherwise drop it
> }
>
> Of course this doesn't help you with A.2, but that's why this draft exists.
>
> If the server can insist on connection IDs from all clients (in the
> far future perhaps, or for an entirely new protocol), then the code is
> more simply:
>
> connection = connection_ids.lookup(packet[connection_id_offset:connection_id_offset+connection_id_length])
> if (!connection) {
>    // is this a ClientHello?  otherwise drop it
> }
>
>> I might be missing something fundamental here, but isn't the length
>> encoded in the CID field on the wire?
> Not by my understanding.  There isn't any need (the intent is to have
> the CID only consumable by the entity that created it, and any others
> that it collaborates with, like a load balancer).
>
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls