Re: [quicwg/base-drafts] Let Endpoints Ignore invalid Initial Packets (#1819)

[ianswett <[e-mail]>]

ianswett commented on this pull request.



> @@ -736,6 +733,18 @@ and will contain a CRYPTO frame with an offset matching the size of the CRYPTO
 frame sent in the first Initial packet.  Cryptographic handshake messages
 subsequent to the first do not need to fit within a single UDP datagram.
 
+### Handling of Fatal Initial Packets
+
+The contents of some Initial packets may, according to this specification, force
+connection termination. For example, they might contain forbidden frame types
+or a CONNECTION_CLOSE frame. As Initial packets are not protected, these could
+indicate injection attacks to terminate the connection.
+
+Endpoints MAY treat the receipt of such packets as a connection error, drop them

I believe we've also said previously we don't care about man on the side attacks, but I think it's clear we do, but we don't want to do a full analysis of them, which leaves us in a weird place.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1819#discussion_r226478559