transport: MUST vs MAY

[kazu-yamamoto]

Sec 12.4 uses MUST:

An endpoint MUST treat receipt of a frame in a packet type that is not permitted as a connection error of type PROTOCOL_VIOLATION.

Sec 12.5 uses MAY:

Note that it is not possible to send the following frames in 0-RTT packets for various reasons: ACK, CRYPTO, HANDSHAKE_DONE, NEW_TOKEN, PATH_RESPONSE, and RETIRE_CONNECTION_ID. A server MAY treat receipt of these frames in 0-RTT packets as a connection error of type PROTOCOL_VIOLATION.

Aren't they contradictory?

[martinthomson]

Not contradictory. These are not impermissible, they are instead impossible. An endpoint is required (MUST) to reject impermissible frames, but merely allows (MAY) to reject impossible frames.

[kazu-yamamoto]

How we can distinguish impermissible and impossible?

[martinthomson]

What is permitted is in the bullet list in S12.5. Anything else is impermissible. What is impossible is noted in the paragraph after that. If you don't care to distinguish the two (which is entirely reasonable), then treat them all as connection errors.

(I think that our code has a mixed stance because we don't care to police based on endpoint role.)

[kazu-yamamoto]

I'm still puzzled in Section 12.4 and 12.5. Which does "Pkts" in the Table 3 mean, permissible or possible?

I guess it's "possible". ACK, CRYPTO, HANDSHAKE_DONE, NEW_TOKEN, PATH_RESPONSE, and RETIRE_CONNECTION_ID are impossible in 0-RTT. But PATH_RESPONSE and RETIRE_CONNECTION_ID are marked with "0".

[martinthomson]

Yes, possible.

[larseggert]

@kazu-yamamoto can this be closed?

[kazu-yamamoto]

@larseggert No. I'm still confused.

[kazu-yamamoto]

@martinthomson

Note that it is not possible to send the following frames in 0-RTT packets for various reasons: ACK, CRYPTO, HANDSHAKE_DONE, NEW_TOKEN, PATH_RESPONSE, and RETIRE_CONNECTION_ID. A server MAY treat receipt of these frames in 0-RTT packets as a connection error of type PROTOCOL_VIOLATION.

This talks about "impossible". This text should be moved to Sec 12.4. And if this text is correct, the 0 mark of NEW_TOKEN, PATH_RESPONSE, and RETIRE_CONNECTION_ID should be removed.

[kazu-yamamoto]

Sec 12.4 talks about "possible" and Sec 12.5 talks about "permissible":

So, "An endpoint MUST treat receipt of a frame in a packet type that is not permitted as a connection error of type PROTOCOL_VIOLATION" should be moved from Sec 12.4 to Sec 12.5.

[LPardue]

Its been 28 days with no updates or PR, what is the status here?

[martinthomson]

The implied proposal was no action. I'm going to close it. There's a narrow window remaining for pull requests still, but we have to draw the line soon.