Re: [quicwg/base-drafts] loss of only two packets can lead to an unrecoverable situation (#2267)

[Christian Huitema <[e-mail]>]

I just completed a PR in Picoquic to fix this issue. What it does:

1) Client side, implicit ACK of the first Initial Packet if the handshake key is received. After that, apply a special parser for Initial frames (see point 4 below)
2) Server side, move to a "ready" state when the 1st 1-RTT packet from client is received; as part of that move, implicit ACK of Initial and Handshake packets sent by the server.
3) Client side, move to the "ready" state when first ACK of 1-RTT packet is received from server. This triggers implicit ACK of Initial and Handshake packets sent by the client.
4) In Ready state, use a specific parser for Initial and Handshake message. Effectively ignore all frames in these packets, but if there is an ACK eliciting frame, schedule an ACK.

This removes a bunch of corner cases, such as spurious retransmit of Initial packets in the middle of a migration. It also closes an avenue for DOS against established connections, since Initial packets cannot anymore change the state of the connection once the handshake is complete.

Well, not quite all attacks: Initial packets can still trigger an ACK that might cause an allergic reaction at the peer. But then, the attacker could also send spoofed ACK in Initial packets directly to the peer, so this is not exactly a new attack. Plus, if the peer adopts the defenses outlined above, the spoofed ACK will have no side effect.


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2267#issuecomment-457982113