Re: [quicwg/base-drafts] Subsequent Initial Packets with Token Field (#1649)

[Nick Banks <[e-mail]>]

@kazuho I guess you're right. I got so focused on the subsequent Initial packets I forgot about the multiple Retry case. The DDoS mitigation device cannot be completely stateless because it cannot rely on its own Token always being in the client's Initial packet, in the multiple Retry case.

As for how forwarding could work for all other non-Initial packets, the simplest design would be to just always let them through, and let the end server drop them if they don't correspond to an existing connection. With that type of design, the DDoS mitigation device just prevents new connections from being created, and ignores all other traffic.

All that being said, then should we be a bit more clear in the spec and say that only the first Initial packets (not sure how best to word that) need carry the server's Token?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1649#issuecomment-412554882