Re: [quicwg/base-drafts] handling of coalesced packets with decryption errors creates DoS opportunity (#2308)

[Kazuho Oku <[e-mail]>]

@huitema 
> implementations are free to drop packets for whatever reason. In the rare cases of false positive, when the funny coalesced packet is not in fact an attack, the peer will just resend after at time out.

IIRC, one of the concerns regarding this approach was that we might see a deadlock if the peer has dropped the keys necessary for processing the the first packet within a datagram, and decides to drop the entire datagram due to not being able to process the first packet. Then, the endpoint might simply retransmit the coalesced datagram that starts from the same packet type as the previous datagram, and that datagram again gets dropped by the server, and ...

Therefore, it has been my view that it is beneficial to specify the minimum requirements that guarantees the connection to make progress. IIRC, my preference was to define a minimum number of packets within a single datagram that a receiver should process. But I am fine with what we have in the text right now, because it does not make the implementations complicated; a sensible sender would never send a datagram containing more than one packet at the same encryption level, detecting them on the receiver-side is an implementation choice.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2308#issuecomment-490692288