diff --git a/draft-ietf-quic-tls.md b/draft-ietf-quic-tls.md index e9f9111123..a42d50f3b8 100644 --- a/draft-ietf-quic-tls.md +++ b/draft-ietf-quic-tls.md @@ -1106,31 +1106,45 @@ protection for the QUIC negotiation. This does not prevent version downgrade during the handshake, though it means that such a downgrade causes a handshake failure. -Protocols that use the QUIC transport MUST use Application Layer Protocol -Negotiation (ALPN) {{!RFC7301}}. The ALPN identifier for the protocol MUST be -specific to the QUIC version that it operates over. When constructing a -ClientHello, clients MUST include a list of all the ALPN identifiers that they -support, regardless of whether the QUIC version that they have currently -selected supports that protocol. +TLS uses Application Layer Protocol Negotiation (ALPN) {{!RFC7301}} to select an +application protocol. The application-layer protocol MAY restrict the QUIC +versions that it can operate over. When constructing a ClientHello, clients +SHOULD include a list of all the ALPN identifiers that they support, regardless +of whether the QUIC version that they have currently selected supports that +protocol. -Servers SHOULD select an application protocol based solely on the information in -the ClientHello, not using the QUIC version that the client has selected. If -the protocol that is selected is not supported with the QUIC version that is in -use, the server MAY send a QUIC version negotiation packet to select a -compatible version. +Servers SHOULD select an application protocol compatible with the QUIC version +that the client has selected, if possible. If the protocol that is selected is +not supported with the QUIC version that is in use, the server MUST send a QUIC +version negotiation packet to select a compatible version. -If the server cannot select a combination of ALPN identifier and QUIC version it -MUST abort the connection. A client MUST abort a connection if the server picks -an incompatible version of QUIC version and ALPN. +If the server cannot select a compatible combination of ALPN identifier and QUIC +version, it MUST abort the connection. A client MUST abort a connection if the +server picks an incompatible combination of QUIC version and ALPN identifier. ## QUIC Extension {#quic_parameters} -QUIC defines an extension for use with TLS. That extension defines -transport-related parameters. This provides integrity protection for these -values. Including these in the TLS handshake also make the values that a client -sets available to a server one-round trip earlier than parameters that are -carried in QUIC packets. This document does not define that extension. +QUIC parameters are carried in a TLS extension. That extension carries +transport-related parameters encoded as an opaque blob whose interpretation is +specific to the QUIC version in use. This provides integrity protection for +these values. Including these in the TLS handshake also makes the values that a +client sets available to a server one round-trip earlier than parameters that +are carried in QUIC packets. This document defines that extension, but does not +specify how parameters are encoded in the blob. + + enum { + quic_transport_parameters(26), (65535) + } ExtensionType; + +The `extension_data` field of the +(`quic_transport_parameters(26)`) extension SHALL +contain a `TransportParameters` value. + + opaque TransportParameters<1..2^16-1>; + +`TransportParameters` contains the opaque blob provided by the QUIC transport +layer. ## Source Address Validation {#source-address} diff --git a/draft-ietf-quic-transport.md b/draft-ietf-quic-transport.md index 258cc93a69..97a19a3c58 100644 --- a/draft-ietf-quic-transport.md +++ b/draft-ietf-quic-transport.md @@ -658,6 +658,14 @@ Version negotiation uses unprotected data. The result of the negotiation MUST be revalidated once the cryptographic handshake has completed (see {{version-validation}}). +The server includes its Version Negotiation list in the crypto handshake even if +the client's proposed version was acceptable. Clients SHOULD cache this list +and initially propose the highest mutual version in the future. Clients which +discover the server would have accepted a higher version than initially proposed +MAY initiate a new connection with the higher version, then gracefully close the +first connection. + + ## Crypto and Transport Handshake {#handshake} QUIC relies on a combined crypto and transport handshake to minimize connection @@ -682,10 +690,47 @@ protocol to be transmitted to the peer. #### Encoding -(TODO: Describe format with example) - -QUIC encodes the transport parameters and options as tag-value pairs, all as -7-bit ASCII strings. QUIC parameter tags are listed below. +QUIC encodes the transport parameters and options as tag-value pairs. + + enum { + SFCW(0), + CFCW(1), + MSPC(2), + ICSL(3), + TCID(4), + COPT(5), + VPRP(6), + VNGO(7), + (255) + } OptionTag; + + opaque TagString<0..2^16-1>; /* String value for experimental tags */ + + opaque QuicVersion[4]; /* Version entry */ + + QuicVersion VersionList<1..255> /* List of versions */ + + struct { + OptionTag tag; /* option being set */ + select (Option.tag) { /* option value */ + case SFCW: uint24 Window; + case CFCW: uint24 Window; + case MSPC: uint16 StreamCount; + case ICSL: uint16 Timeout; + case TCID: opaque Ignored; + case COPT: TagString OptionValue; + case VPRP: QuicVersion ProposedVersion; + case VNGO: VersionList SupportedVersions; + } + } Option + + struct { + Option option_list<0..255> + } OptionList + +The OptionList is passed to the crypto layer to be transported in the handshake +and cryptographically verified. + #### Required Transport Parameters {#required-transport-parameters} @@ -699,6 +744,13 @@ QUIC encodes the transport parameters and options as tag-value pairs, all as * ICSL: Idle timeout in seconds. The maximum value is 600 seconds (10 minutes). +* VPRP: Client's initially-proposed version (whether or not selected). MUST be + sent by client; MUST NOT be sent by server. + +* VNGO: Server's list of supported versions. MUST be sent by server, regardless + of whether a Version Negotiation packet was sent; MUST NOT be sent by client. + + #### Optional Transport Parameters * TCID: Indicates support for truncated Connection IDs. If sent by a peer, @@ -775,6 +827,10 @@ protocol. mid-connection, to update the information stored in the STK at the client and to extend the period over which 0-RTT connections can be established by the client. + +* Application-Layer Protocol Negotiation: The handshake MUST establish the + application-layer protocol which the peers will speak over the QUIC + connection. * Certificate Compression: Early QUIC experience demonstrated that compressing certificates exchanged during a handshake is valuable in reducing latency. @@ -789,9 +845,9 @@ protocol. The following information used during the QUIC handshake MUST be cryptographically verified by the crypto handshake protocol: -* Client's originally proposed version in its first packet. +* Client's originally-proposed version in its first packet. -* Server's version list in it's Version Negotiation packet, if one was sent. +* Server's version list. ## Connection Migration {#migration}