Re: [quicwg/base-drafts] Limit RCID state (#3547)

[Kazuho Oku <[e-mail]>]

@kazuho requested changes on this pull request.



> @@ -1069,6 +1069,18 @@ to cease using the connection IDs when requested can result in connection
 failures, as the issuing endpoint might be unable to continue using the
 connection IDs with the active connection.
 
+An endpoint MAY elect to only send or retransmit RETIRE_CONNECTION_ID frames
+with sequence numbers greater than or equal to the highest Retire Prior To field
+received minus its advertised active_connection_id_limit. This bounds the

I'm afraid this advice might be inadequate.

It is possible to mount attacks without using Retire Prior To (see https://github.com/quicwg/base-drafts/issues/3509#issuecomment-597970501), and therefore the defense should rather not depend on the value of Retire Prior To.

I think it would be better to state that:
* An endpoint SHOULD limit the number of unacknowledged RETIRE_CONNECTION_ID frames (or the count of sequence numbers contained in those frames) that the endpoint tracks.
* That limitation SHOULD be no less than 2 * max_connection_id_limit.

I think that was what @martinthomson had in mind when he wrote https://github.com/quicwg/base-drafts/issues/3509#issuecomment-597425775.

`2 * max_connection_id_limit` is a better ballpark figure than `max_connection_id_limit`, because it gives some confidence to the issuer of CIDs that it can issue a new CID immediately when it receives RCID, without the fear of that causing some state to be lost in the peer.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3547#pullrequestreview-382494284