]> Ethereum Foundation

marco@marcopolo.io

Smallstep

martenseemann@gmail.com

Transport QUIC Internet-Draft This document specifies an extension to QUIC to allow a server to request a migration to a new preferred address. About This Document The latest revision of this draft can be found at . Status information for this document may be found at . Discussion of this document takes place on the QUIC Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .

Introduction The QUIC transport protocol allows a client to migrate connections at any time to any new address (). This allows the connection to survive changes to the client's address. QUIC also allows a server to migrate to a different address, but only a single time, and only to an address specified at the start of a connection via the Server's Preferred Address (). For some applications, including those where the server and client are peers, limiting the server to only a single migration at the beginning is too limiting. This document specifies an extension to QUIC to allow a server to request a migration to a new preferred address. This document defines a new transport parameter that indicates support of this extension and specifies a new frame type to inform the client of the server's new preferred address.

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Motivation In peer to peer networks, the role of server and client is arbitrary. An endpoint may serve as a client in one connection and a server in another. Limiting connection migration to clients limits the flexibility of endpoints in this network. A peer in this network would like to migrate all of its connections, not just the ones it happens to be a client in. While it is not the primary goal, this extension may also assist in NAT traversal by migrating to a dynamically chosen server address. A server could have a client connect over a relay, and later migrate to a direct connection after applying NAT traversal techniques. The specific NAT traversal techniques are out of scope of this document.

Negotiating Extension Use new_preferred_address (0xff0969d85c): Clients advertise their support of this extension by sending the new_preferred_address (0xff0969d85c) transport parameter () with an empty value. Sending this transport parameter signals to the server that the client understands the NEW_PREFERRED_ADDRESS frame. Servers MUST NOT send this transport parameter. A client that supports this extension and receives this transport parameter MUST abort the connection with a TRANSPORT_PARAMETER_ERROR. Endpoints MUST NOT remember the value of this extension for 0-RTT.

New Preferred Address Frame A server can use an NEW_PREFERRED_ADDRESS frame to request the client to migrate the connection to the provided server address. Upon receiving an NEW_PREFERRED_ADDRESS, the client MAY initiate migration. If the client does migrate it MUST adhere to the client behavior defined in . The NEW_PREFERRED_ADDRESS is defined as follows: Following the common frame format described in , NEW_PREFERRED_ADDRESS frames have a type of 0x1d5845e2, and contain the following fields:

Sequence Number:

A variable-length integer representing the sequence number assigned to the NEW_PREFERRED_ADDRESS frame by the sender so receivers can ignore obsolete frames. A sending endpoint MUST send monotonically increasing values in the Sequence Number field to allow obsolete NEW_PREFERRED_ADDRESS frames to be ignored when packets are processed out of order.

IPv4 and IPv6 Address and Port:

Analogous to the preferred_address transport parameter, this frame contains an address and port for both IPv4 and IPv6. The four-byte IPv4 Address field is followed by the associated two-byte IPv4 Port field. This is followed by a 16-byte IPv6 Address field and two-byte IPv6 Port field.

NEW_PREFERRED_ADDRESS frames are ack-eliciting, and MUST only be sent in the application data packet number space. The server SHOULD ensure that its peer has a sufficient number of available and unused connection IDs, as the client will be unable to migrate without an unused connection ID. The server MAY bundle a NEW_CONNECTION_ID frame with the NEW_PREFERRED_ADDRESS. Likewise, the client should ensure the same to allow the server to probe new paths.

Security Considerations

Request Forgery Attacks The same considerations from apply here as well.

DDoS - Thundering herd A malicious server could wait until it has received a large number of clients, and request a migration from all of them at the same time to a victim endpoint. If the clients all migrate at the same time, they may overload or otherwise negatively impact the victim endpoint. Clients may mitigate this by randomly delaying the migration.

IANA Considerations

QUIC Transport Parameter This document registers the new_preferred_address transport parameter in the "QUIC Transport Parameters" registry established in . The following fields are registered:

Value:

0xff0969d85c

Parameter Name:

new_preferred_address

Status:

Provisional

Specification:

This document

Change Controller:

IETF (iesg@ietf.org)

Contact:

Marco Munizaga (marco@marcopolo.io)

QUIC Frame Types This document registers one new value in the "QUIC Frame Types" registry established in . The following fields are registered:

Value:

0x1d5845e2

Frame Type Name:

NEW_PREFERRED_ADDRESS

Status:

Provisional

Specification:

This document

Change Controller:

IETF (iesg@ietf.org)

Contact:

Marco Munizaga (marco@marcopolo.io)

Normative References Fastly Mozilla In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.

Acknowledgments TODO acknowledge.

TODOs

Questions

• Any new security conserations from allowing a dynamically chosen preferred address?
• Any new security conserations from allowing a deferred chosen preferred address?