Re: [quicwg/base-drafts] Let Endpoints Ignore invalid Initial Packets (#1819)

[Mike Bishop <[e-mail]>]

MikeBishop commented on this pull request.



> @@ -736,6 +733,18 @@ and will contain a CRYPTO frame with an offset matching the size of the CRYPTO
 frame sent in the first Initial packet.  Cryptographic handshake messages
 subsequent to the first do not need to fit within a single UDP datagram.
 
+### Handling of Fatal Initial Packets
+
+The contents of some Initial packets may, according to this specification, force

I'm not a big fan of a specification saying you can ignore the specification; I'd prefer consistency.  You removed the language above indicating that things should be fatal, so you're part-way there.

Perhaps something like "Receipt of an invalid Initial packet could indicate an injection attack rather than a peer failure.  Endpoints abort a connection attempt if no valid Initial packets are received after an appropriate timeout."  That gives enough latitude that the timeout could be immediate or a long observation for multiple possibilities.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1819#pullrequestreview-161350765