Re: [quicwg/base-drafts] Let Endpoints Ignore invalid Initial Packets (#1819)

ianswett <> Thu, 18 October 2018 21:55 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 64196130E89 for <>; Thu, 18 Oct 2018 14:55:36 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -8.064
X-Spam-Status: No, score=-8.064 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id D8qG7IInKeIm for <>; Thu, 18 Oct 2018 14:55:34 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 310D9130E94 for <>; Thu, 18 Oct 2018 14:55:34 -0700 (PDT)
Date: Thu, 18 Oct 2018 14:55:33 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=pf2014; t=1539899733; bh=lV3m0JoJt0nvfLt3GbFTuEbFBmFIFxAPmn1RAF56oRo=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=1fb06DzKd5c2nOkPNdsBiO07jdW/qWIqvGtR7n080NcEcY+m08hOrGigr/jzc0rxn lbgdRlTfU2RxNBqtbEbA+ox91XssEqu+Tn0E/XcNuLG2B8S9wfUkukFyTNPSvQzyh1 1XLTixqORs5QmV3sLdfCA6GIWJfKnmm6dpQJfgLQ=
From: ianswett <>
Reply-To: quicwg/base-drafts <>
To: quicwg/base-drafts <>
Cc: Subscribed <>
Message-ID: <quicwg/base-drafts/pull/1819/review/>
In-Reply-To: <quicwg/base-drafts/pull/>
References: <quicwg/base-drafts/pull/>
Subject: Re: [quicwg/base-drafts] Let Endpoints Ignore invalid Initial Packets (#1819)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5bc9015533e53_38173fc1ab4d45c0250755"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: ianswett
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
Archived-At: <>
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 18 Oct 2018 21:55:45 -0000

ianswett commented on this pull request.

> @@ -736,6 +733,18 @@ and will contain a CRYPTO frame with an offset matching the size of the CRYPTO
 frame sent in the first Initial packet.  Cryptographic handshake messages
 subsequent to the first do not need to fit within a single UDP datagram.
+### Handling of Fatal Initial Packets
+The contents of some Initial packets may, according to this specification, force
+connection termination. For example, they might contain forbidden frame types
+or a CONNECTION_CLOSE frame. As Initial packets are not protected, these could
+indicate injection attacks to terminate the connection.
+Endpoints MAY treat the receipt of such packets as a connection error, drop them

I believe we've also said previously we don't care about man on the side attacks, but I think it's clear we do, but we don't want to do a full analysis of them, which leaves us in a weird place.

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub: