Subject: Re: [quicwg/base-drafts] Allow server to enforce post-Retry packet numbering (#3989)

From: Lucas Pardue <[email-masked]>
Date: Tue, 01 Sep 2020 15:48:57 -0700

Based on the discussion of the issue during consensus call, I'd like to mark this as `has-consensus` within 24 hours. And have someone create a spin-off issue for a general-sense review of use of MAYs, if they believe there is a strong need for it. (see https://github.com/quicwg/base-drafts/pull/3990#discussion_r479589737).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3989#issuecomment-685174509

---

From: Marten Seemann <[email-masked]>
Date: Tue, 01 Sep 2020 19:48:06 -0700

As pointed out by @ekr on the mailing list, #3990 adds little value to the spec.
Every MUST can be enforced by aborting the connection. I'm not convinced that adding a "The peer MAY abort the connection if *this* MUST is violated" after every MUST increases the clarity of the spec.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3989#issuecomment-685253943

---

From: ekr <[email-masked]>
Date: Tue, 01 Sep 2020 19:53:30 -0700

As with @marten-seemann my preference here is for parsimony (I would feel different if there were a SHOULD). However, I'm not going to go to the mat as long as we add a statement somewhere that you are generally permitted to respond to every MUST violation by closing the connection; if we do that it's just superfluous.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3989#issuecomment-685255653

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 01 Sep 2020 20:23:35 -0700

As stated in https://github.com/quicwg/base-drafts/pull/3990#discussion_r481592574, detecting MUST violations for Handshake and ApplicationData packets is fine because they are protected by the secrets, but not for unprotected information.

Therefore, it makes sense to have a MAY here.

My limited experience tells me that we have different customs between WGs. I tend to believe that document produced by TLS WG assume that a MUST implies "peer MAY detect." And that's fine because TLS does not care about attacks against the underlying transport, and hence any violation is considered as misbehavior of the peer. In contrast, MUST in the recovery draft is not enforceable at all. HTTP is in a middle ground, HTTP/2 has many MAY detect rules for misbehaving peers. That might be due to the history of HTTP being a very lax protocol.

I know that the differences are confusing, but I think they all have reasons, and am perfectly fine with keeping status-quo.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3989#issuecomment-685266377

---

From: Marten Seemann <[email-masked]>
Date: Tue, 01 Sep 2020 20:26:00 -0700

@kazuho Do we have any MUST in the (QUIC) spec for which it's *forbidden* (i.e. the peer MUST NOT) to enforce it? I don't think so.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3989#issuecomment-685267281

---

From: Marten Seemann <[email-masked]>
Date: Tue, 01 Sep 2020 20:40:57 -0700

In my opinion, instead of a piecemeal solution as suggested here, it would make more sense to add a general statement like the following:

> An endpoint MAY abort the connection if it detects that the peer violated a protocol requirement. An endpoint MAY ignore a packet that would otherwise cause it to abort the connection only if the packet contents are unauthenticated (that is, for Initial, Version Negotiation and Retry packets).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3989#issuecomment-685272007

---

From: Martin Thomson <[email-masked]>
Date: Tue, 01 Sep 2020 20:58:28 -0700

That seems to be the core of the issue that people are suggesting we open.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3989#issuecomment-685277519

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 01 Sep 2020 21:57:17 -0700

@marten-seemann 
> Do we have any MUST in the (QUIC) spec for which it's forbidden (i.e. the peer MUST NOT) to enforce it?

One example that I can immediately recall is the handling of Version Negotiation packet. An endpoint (including client) is forbidden to respond to a Version Negotiation packet with a Version Negotiation packet, but the server is forbidden to recognize Version Negotiation packets.

Re writing down the principles, my +1 goes to opening a new issue.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3989#issuecomment-685296019

---

From: Lucas Pardue <[email-masked]>
Date: Wed, 02 Sep 2020 14:26:48 -0700

In the interest of not getting tied up on this, I'm declaring consensus to merge the PR and ask one of the folks in favour of taking a broad brush look to open an issue to continue that discussion and track any proposals that get made to do so.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3989#issuecomment-686026604

---

From: Jana Iyengar <[email-masked]>
Date: Thu, 10 Sep 2020 09:59:06 -0700

Closed #3989 via #3990.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3989#event-3722780514