Subject: Padding Initial packets

From: "Martin Thomson" <[email-masked]>
Date: Wed, 13 Mar 2019 23:24:07 -0400

In the interests of full transparency, and because the issue[1] and PR[2] involved are only editorial, I'd like to put something on the list.  In short, no change is being made here, but there is a technical decision that might be worth validating in that.

We currently require that all UDP datagrams containing an Initial packet be padded to 1200 bytes.  Though that is not changing, there was an idea that we might not need to pad all such datagrams.  Maybe there were some cases where this could be optimized (in retrospect, that should have been a red flag).  For instance, if the client were to send an Initial packet containing only an ACK, that might not need to be padded.

After consideration, we concluded that the DoS protections depend on padding and we would not change the requirement.  Failing to pad datagrams containing Initial packets could mean that the server is unable to send very much data in certain corner cases, leading to something akin to silly window syndrome.  The only reason a client might send an Initial packet in a smaller datagram is because you were certain that the server had validated the path.  And, depending on the outcome of discussions about discarding keys, those Initial packets might not be sent at all.

Based on that, I'm somewhat inclined to make a separate change: to remove the exception for Initial packets sent after path validation.  It's a difficult condition to test for and sending the packet is going to be unnecessary, so maybe we can remove a whole sentence from our 180 page spec.  (That would be a change, of course.)

[1] https://github.com/quicwg/base-drafts/issues/2519
[2] https://github.com/quicwg/base-drafts/issues/2520

---

From: Ian Swett <[email-masked]>
Date: Thu, 14 Mar 2019 16:16:16 -0400

As I said on the issue, I agree with your judgement.  I don't believe the
PR clearly states what you wrote in this email, because the sentence below
is either incorrect (because I can stop padding Initials at some point )or
it's confusing(because it really means you can stop padding non-Initial
packets).
"Once a client has received an acknowledgment for a Handshake packet it MAY
send smaller datagrams."

Thanks for clarifying this.

On Wed, Mar 13, 2019 at 11:24 PM Martin Thomson <[email-masked]> wrote:

> In the interests of full transparency, and because the issue[1] and PR[2]
> involved are only editorial, I'd like to put something on the list.  In
> short, no change is being made here, but there is a technical decision that
> might be worth validating in that.
>
> We currently require that all UDP datagrams containing an Initial packet
> be padded to 1200 bytes.  Though that is not changing, there was an idea
> that we might not need to pad all such datagrams.  Maybe there were some
> cases where this could be optimized (in retrospect, that should have been a
> red flag).  For instance, if the client were to send an Initial packet
> containing only an ACK, that might not need to be padded.
>
> After consideration, we concluded that the DoS protections depend on
> padding and we would not change the requirement.  Failing to pad datagrams
> containing Initial packets could mean that the server is unable to send
> very much data in certain corner cases, leading to something akin to silly
> window syndrome.  The only reason a client might send an Initial packet in
> a smaller datagram is because you were certain that the server had
> validated the path.  And, depending on the outcome of discussions about
> discarding keys, those Initial packets might not be sent at all.
>
> Based on that, I'm somewhat inclined to make a separate change: to remove
> the exception for Initial packets sent after path validation.  It's a
> difficult condition to test for and sending the packet is going to be
> unnecessary, so maybe we can remove a whole sentence from our 180 page
> spec.  (That would be a change, of course.)
>

---

From: "Martin Thomson" <[email-masked]>
Date: Thu, 14 Mar 2019 21:31:37 -0400

On Fri, Mar 15, 2019, at 07:16, Ian Swett wrote:
> As I said on the issue, I agree with your judgement. I don't believe 
> the PR clearly states what you wrote in this email, because the 
> sentence below is either incorrect (because I can stop padding Initials 
> at some point )or it's confusing(because it really means you can stop 
> padding non-Initial packets).
> "Once a client has received an acknowledgment for a Handshake packet it 
> MAY send smaller datagrams."

I didn't suggest this in the discussion on the issue, but - as I said - removing that sentence is the right thing to do.  As we discovered, this is an optimization for a non-existent condition.  It is, however, a technical change, so I will probably suggest that we move ahead with the editorial change and open an issue for removing this line.