Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

QASM: A Novel Framework for QUIC-Aware Stateful Middleboxes

Hari Hara Sudhan Selvam, Sameer G. Kulkarni

TL;DR

QASM presents a generalized, migration aware framework that enables QUIC aware tracking for stateful middleboxes, addressing the disruption caused by QUIC connection migration and CID based flow identification. It introduces three components—the Client Agent, Tracking Agent, and QUIC aware middlebox—and demonstrates that the approach maintains accurate flow tracking with negligible overhead in NAT and rate limiter scenarios. The evaluation shows correct tracking across migrations and minimal impact on latency and throughput, even under high migration rates, making it practical for deployment in enterprise networks and Kubernetes environments. The work offers a practical path to preserve middlebox functionality amid evolving transport layer protocols like HTTP/3.

Abstract

Stateful Middleboxes are integral part of enterprise and campus networks that provide essential in-network, security, and value-added services. These stateful middleboxes rely on precise network flow identification. However, the adoption of HTTP/3, which uses the QUIC protocol, poses significant challenges to the proper functioning of these devices. QUIC's encryption and connection migration features obscure flow semantics, disrupting middlebox visibility and functionality. We examine how QUIC disrupts middleboxes like Network Address Translators (NATs), Rate Limiters, Load Balancers, etc., and affects Kubernetes-based service deployments. To address these challenges, we propose a novel, generalized framework that enables stateful middleboxes to reliably track QUIC connections, even when the endpoints change their internet protocol (IP) address or port numbers. Our prototype implementation demonstrates that the proposed approach preserves middlebox functionality with HTTP/3 with negligible performance overhead (< 5%) on both throughput and latency, and works effectively even under high QUIC connection migration rates of up to 100 Hz.

QASM: A Novel Framework for QUIC-Aware Stateful Middleboxes

TL;DR

QASM presents a generalized, migration aware framework that enables QUIC aware tracking for stateful middleboxes, addressing the disruption caused by QUIC connection migration and CID based flow identification. It introduces three components—the Client Agent, Tracking Agent, and QUIC aware middlebox—and demonstrates that the approach maintains accurate flow tracking with negligible overhead in NAT and rate limiter scenarios. The evaluation shows correct tracking across migrations and minimal impact on latency and throughput, even under high migration rates, making it practical for deployment in enterprise networks and Kubernetes environments. The work offers a practical path to preserve middlebox functionality amid evolving transport layer protocols like HTTP/3.

Abstract

Stateful Middleboxes are integral part of enterprise and campus networks that provide essential in-network, security, and value-added services. These stateful middleboxes rely on precise network flow identification. However, the adoption of HTTP/3, which uses the QUIC protocol, poses significant challenges to the proper functioning of these devices. QUIC's encryption and connection migration features obscure flow semantics, disrupting middlebox visibility and functionality. We examine how QUIC disrupts middleboxes like Network Address Translators (NATs), Rate Limiters, Load Balancers, etc., and affects Kubernetes-based service deployments. To address these challenges, we propose a novel, generalized framework that enables stateful middleboxes to reliably track QUIC connections, even when the endpoints change their internet protocol (IP) address or port numbers. Our prototype implementation demonstrates that the proposed approach preserves middlebox functionality with HTTP/3 with negligible performance overhead (< 5%) on both throughput and latency, and works effectively even under high QUIC connection migration rates of up to 100 Hz.
Paper Structure (33 sections, 9 figures, 1 table, 9 algorithms)

This paper contains 33 sections, 9 figures, 1 table, 9 algorithms.

Table of Contents

  1. Introduction
  2. Motivation: Impact of HTTP/3 (QUIC) on Stateful Middleboxes
  3. Denial of Service on NAT
  4. Impact on Load Balancers
  5. Impact on Rate Limiters
  6. Impact on Kubernetes-based deployments
  7. Architecture and System Design
  8. Design Goals
  9. Tracking Attributes
  10. System Architecture
  11. Client Agent
  12. Tracking Agent
  13. QUIC-aware Stateful Middlebox
  14. Implementation
  15. Evaluation
  16. ...and 18 more sections

Figures (9)

  • Figure 1: Network Stack of HTTP/2 and HTTP/3
  • Figure 2: DoS with HTTP/3 and NAT. QUIC packets of same connection with different network address. The number on top of the packet indicates the UDP Source port number.
  • Figure 3: Packets of the same QUIC connection get mapped to different servers post-connection migration. The number on top of the packet indicates the UDP Source port number.
  • Figure 4: Flow based RL creating multiple flows for a single HTTP/3 connection after connection migration. The number on top of the packet indicates the UDP Source port number.
  • Figure 5: Kubernetes Conntrack Flooding by QUIC Migration
  • ...and 4 more figures