[quicwg/base-drafts] Increase resilience to spoofed Version Negotiation packets (#524)
Martin Thomson <notifications@github.com> Fri, 12 May 2017 06:10 UTC
Return-Path: <bounces+848413-a050-quic-issues=ietf.org@sgmail.github.com>
X-Original-To: quic-issues@ietfa.amsl.com
Delivered-To: quic-issues@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 832C01294D2 for <quic-issues@ietfa.amsl.com>; Thu, 11 May 2017 23:10:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.8
X-Spam-Level:
X-Spam-Status: No, score=-4.8 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-2.8, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J5yw_y6cRlex for <quic-issues@ietfa.amsl.com>; Thu, 11 May 2017 23:10:16 -0700 (PDT)
Received: from o5.sgmail.github.com (o5.sgmail.github.com [192.254.113.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 19915129BF6 for <quic-issues@ietf.org>; Thu, 11 May 2017 23:04:59 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=BAgEXqWhSCmZLo9FyPkD+cW7WT4=; b=BWge3UPGVuqjhdzk JQPY3MKG+GTG/MnzqzN6+UWlk8H0FaHsemgBDzSJBHFRmFgYMVEoZ/qjplJ8Bn0I 3vlxRzUb5bExNqcsk5wbp8gaSgsHTbylDt7/hgcY2dnYpOBb4u+ZFdsJ5wOBpKaw srRlGZOGLfsrZoifpsFgluSotX0=
Received: by filter0949p1mdw1.sendgrid.net with SMTP id filter0949p1mdw1-25124-5915508A-1A 2017-05-12 06:04:58.311139708 +0000 UTC
Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2b-ext-cp1-prd.iad.github.net [192.30.253.17]) by ismtpd0027p1mdw1.sendgrid.net (SG) with ESMTP id 5nQFzIFpQt22bdc8ALh8PA for <quic-issues@ietf.org>; Fri, 12 May 2017 06:04:58.213 +0000 (UTC)
Date: Thu, 11 May 2017 23:04:58 -0700
From: Martin Thomson <notifications@github.com>
Reply-To: quicwg/base-drafts <reply+0166e4ab7121c62daebe5d846f5c3668ebf4ee62aa37690892cf00000001152d128a92a169ce0d99fec5@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/pull/524@github.com>
Subject: [quicwg/base-drafts] Increase resilience to spoofed Version Negotiation packets (#524)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5915508a49a2_9643fd934d35c3c116753"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: martinthomson
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
X-GitHub-Recipient-Address: quic-issues@ietf.org
X-SG-EID: l64QuQ2uJCcEyUykJbxN122A6QRmEpucztpreh3Pak0F73GEVWbL+gVYx9dPq98EymCD0wYy8Im1o3 bHDLyeYjmbfybLP3axXS9XKORQ4QMBcsIoTfgNyjFdp099AvF1/bpq+roF/LVgoSxeGNEK8d0wFgAa FJRM2E3mkSxygJRCzdWw5GJmECaUYOZj3TZvnuzEL/CN8VcUbrmQn1shXhWEL3dBJEvww49Dnm99S4 g=
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/2Zi8yyRdgKM_xfpx7QgZ__s9ZE8>
X-BeenThere: quic-issues@ietf.org
X-Mailman-Version: 2.1.22
List-Id: Notification list for GitHub issues related to the QUIC WG <quic-issues.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic-issues/>
List-Post: <mailto:quic-issues@ietf.org>
List-Help: <mailto:quic-issues-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 12 May 2017 06:10:19 -0000
There's two layers of defense here: 1. Version Negotiation echoes 31-bits of entropy (maybe more if you consider the version to be at all unpredictable, or the client's source address to contain any entropy). 2. If validation fails and version negotiation happened, encourage the client to try again ignoring any Version Negotiation packets that match the failed profile. Closes #523. You can view, comment on, or merge this pull request online at: https://github.com/quicwg/base-drafts/pull/524 -- Commit Summary -- * Increase resilience to spoofed Version Negotiation packets -- File Changes -- M draft-ietf-quic-transport.md (33) -- Patch Links -- https://github.com/quicwg/base-drafts/pull/524.patch https://github.com/quicwg/base-drafts/pull/524.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/quicwg/base-drafts/pull/524
- [quicwg/base-drafts] Increase resilience to spoof… Martin Thomson
- Re: [quicwg/base-drafts] Increase resilience to s… Mike Bishop
- Re: [quicwg/base-drafts] Increase resilience to s… janaiyengar
- Re: [quicwg/base-drafts] Increase resilience to s… janaiyengar
- Re: [quicwg/base-drafts] Increase resilience to s… janaiyengar
- Re: [quicwg/base-drafts] Increase resilience to s… Martin Thomson
- Re: [quicwg/base-drafts] Increase resilience to s… janaiyengar
- Re: [quicwg/base-drafts] Increase resilience to s… Martin Thomson
- Re: [quicwg/base-drafts] Increase resilience to s… MikkelFJ
- Re: [quicwg/base-drafts] Increase resilience to s… Martin Thomson
- Re: [quicwg/base-drafts] Increase resilience to s… Martin Thomson