Re: [quicwg/base-drafts] Remove some cruft from packet size section (#3262)

[Nick Banks <[e-mail]>]

nibanks commented on this pull request.



>  A server MAY send a CONNECTION_CLOSE frame with error code PROTOCOL_VIOLATION in
-response to the first Initial packet it receives from a client if the UDP
-datagram is smaller than 1200 bytes. It MUST NOT send any other frame type in
-response, or otherwise behave as if any part of the offending packet was
-processed as valid.
+response to an Initial packet it receives from a client if the UDP datagram is
+smaller than 1200 bytes. It MUST NOT send any other frame type in response, or

I'm more worried about this as an attack vector. Now that we support multiple initial packets for the client initial, there is more of a windows for an attacker to race a bad initial packet. Sending a 1 byte initial packet to kill your connection would be pretty easy; especially since the size validation check is going to happen pre-decryption, so the attacker doesn't even need to craft a well-formed packet.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3262#discussion_r347728735