Re: [quicwg/base-drafts] Remove some cruft from packet size section (#3262)

Nick Banks <notifications@github.com> Tue, 19 November 2019 04:44 UTC

Return-Path: <noreply@github.com>
X-Original-To: quic-issues@ietfa.amsl.com
Delivered-To: quic-issues@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92EC01200F1 for <quic-issues@ietfa.amsl.com>; Mon, 18 Nov 2019 20:44:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.597
X-Spam-Level:
X-Spam-Status: No, score=-6.597 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5omv1akdt7mk for <quic-issues@ietfa.amsl.com>; Mon, 18 Nov 2019 20:44:11 -0800 (PST)
Received: from out-19.smtp.github.com (out-19.smtp.github.com [192.30.252.202]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B94B912006F for <quic-issues@ietf.org>; Mon, 18 Nov 2019 20:44:11 -0800 (PST)
Received: from github-lowworker-25680bd.va3-iad.github.net (github-lowworker-25680bd.va3-iad.github.net [10.48.17.61]) by smtp.github.com (Postfix) with ESMTP id 1B6A252006A for <quic-issues@ietf.org>; Mon, 18 Nov 2019 20:44:11 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1574138651; bh=eHFom2phQ2BevJsj/gZ34RU4IKplga2RSeQDvgcI+6M=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=ZkHtIuNzE6nk+Z2ppeexyhhguTd/r+QruQ3/JqWQBa7VuIlFJ86of4dC0zDkE7hbv eiRVWqlbKWwGLOhBkelQY2YoOKCkHaPjYYvTzTiNZfenmwbSw/dabk3ND28/71C+bS QGqQoVnx+kOmZGB/P7ga9qGGyWOa3WHndN+TpGXU=
Date: Mon, 18 Nov 2019 20:44:11 -0800
From: Nick Banks <notifications@github.com>
Reply-To: quicwg/base-drafts <reply+AFTOJK52UA6RKJSUIPMSKIN34CSZXEVBNHHB6RS4SQ@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/pull/3262/review/318781433@github.com>
In-Reply-To: <quicwg/base-drafts/pull/3262@github.com>
References: <quicwg/base-drafts/pull/3262@github.com>
Subject: Re: [quicwg/base-drafts] Remove some cruft from packet size section (#3262)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5dd3731bc1fa_613a3f84f0ccd968144633"; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: nibanks
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
X-GitHub-Recipient-Address: quic-issues@ietf.org
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/2hcpk8UMgozmJo_fhZlMl95t_Jg>
X-BeenThere: quic-issues@ietf.org
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <quic-issues.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic-issues/>
List-Post: <mailto:quic-issues@ietf.org>
List-Help: <mailto:quic-issues-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 19 Nov 2019 04:44:14 -0000

nibanks commented on this pull request.



>  A server MAY send a CONNECTION_CLOSE frame with error code PROTOCOL_VIOLATION in
-response to the first Initial packet it receives from a client if the UDP
-datagram is smaller than 1200 bytes. It MUST NOT send any other frame type in
-response, or otherwise behave as if any part of the offending packet was
-processed as valid.
+response to an Initial packet it receives from a client if the UDP datagram is
+smaller than 1200 bytes. It MUST NOT send any other frame type in response, or

I'm more worried about this as an attack vector. Now that we support multiple initial packets for the client initial, there is more of a windows for an attacker to race a bad initial packet. Sending a 1 byte initial packet to kill your connection would be pretty easy; especially since the size validation check is going to happen pre-decryption, so the attacker doesn't even need to craft a well-formed packet.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3262#discussion_r347728735