Re: [v6ops] Fwd: I-D Action: draft-vyncke-v6ops-happy-eyeballs-cookie-00.txt

[Mark ZZZ Smith <[e-mail]>]

>________________________________
> From: Fred Baker (fred) <[e-mail]>
>To: Erik Nygren <[e-mail]> 
>Cc: IPv6 Operations <[e-mail]> 
>Sent: Wednesday, 29 October 2014, 8:19
>Subject: Re: [v6ops] Fwd: I-D Action: draft-vyncke-v6ops-happy-eyeballs-cookie-00.txt
> 
>
>
>
>
>On Oct 28, 2014, at 2:07 PM, Erik Nygren <[e-mail]> wrote:
>
>On Tue, Oct 28, 2014 at 10:29 AM, Fred Baker (fred) <[e-mail]> wrote:
>
>I would be interested in folks’ view of this. Is this interesting?
>>
>
>
>This is mentioned in section 8.2 of rfc6883 but keeps coming up over and over again
>
>so may be worth calling out more clearly.  I'd title it in some way that didn't make it seem like
>a happy eyeball specific issue.
>
>It's not just a happy eyeballs issue.  It also happens with dual-stack environments where cookies or session or authentication tokens span origins where some servers are dual-stack and some are IPv4-only.   (For example, an auth granting service grants bearer tokens locked to the client IP address and then the client connects to some other service on a different hostname and passes along the tokens.  Even absent Happy Eyeballs these can be on different IP versions.)

I'd think Multipath TCP could also cause these issues, as the MPTCP subflows are not limited to the IP protocol that application 'thinks' it is talking. Even MPTCP subflows of the same IP version to the same destination across session might end up with this issue if the subflows come up in different order.


>
>
>
>An important thing, in my mind, is that Happy Eyeballs isn’t fundamentally about IPv4 and IPv6, it’s about multihoming, which is to say that I have more than one address and more than one route, and it is conceivable that one or more of my addresses or routes doesn’t work. If I am multihomed in the sense of having multiple IPv4 paths, I can have the same problems, and I can have the same problems if I am IPv6-only but have multiple upstreams.
>
>
>
>
>
>The large-scale NAT/CGN issue does make this not just an IPv6 issue.  At least some systems I've seen then check the IP in the cookie to make sure it's in the same /24 rather than the exact same IP, but that doesn't help in the dual-stack world.
>>
>>Another issue beyond Happy Eyeballs is that privacy addressing bites you here as well for cookies that are used across different TCP connections spanning a privacy address rotation.
>>
>>
>>Having some more clear "don't do this" to point people to would be good, but I suspect we'll have many years of cleaning up applications doing this.
>>
>
>
>_______________________________________________
>v6ops mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/v6ops
>
>
>