Re: [quicwg/base-drafts] Defend against endless Stateless Reset ping-pong (#1627)

[ianswett <[e-mail]>]

ianswett commented on this pull request.



> +#### Looping {#reset-looping}
+
+The design of a Stateless Reset is such that it is indistinguishable from a
+valid packet.  This means that a Stateless Reset might trigger the sending of a
+Stateless Reset in response, which could lead to infinite exchanges.  An
+endpoint MUST use any one of the following measures to limit the sending of
+Stateless Reset:
+
+* An endpoint can remember the number of Stateless Reset packets that it has
+  sent and stop generating new Stateless Reset packets once a limit is reached.
+  Using separate limits for different remote addresses - or different values for
+  the Destination Connection ID fields on the packet that triggers the reset -
+  will ensure that Stateless Reset packets can be used to close connections when
+  other peers or connections have exhausted limits.
+
+* An endpoint can ensure that every Stateless Reset that it sends is smaller

I think it's worth advising that a stateless reset should never be larger than the received packet.  This makes this defense unilaterally useful, because at least one side is reducing the size every time.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1627#pullrequestreview-142609921