Re: [quicwg/base-drafts] Subsequent Initial Packets with Token Field (#1649)

Kazuho Oku <notifications@github.com> Mon, 13 August 2018 15:07 UTC

Date: Mon, 13 Aug 2018 08:07:25 -0700
From: Kazuho Oku <notifications@github.com>
Reply-To: quicwg/base-drafts <reply+0166e4abb5ec884f6a6e6271ea4a8f9240843313bd22db2692cf00000001178960ad92a169ce14d6881b@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/1649/412551467@github.com>
In-Reply-To: <quicwg/base-drafts/issues/1649@github.com>
References: <quicwg/base-drafts/issues/1649@github.com>
Subject: Re: [quicwg/base-drafts] Subsequent Initial Packets with Token Field (#1649)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5b719ead10bcc_4be3f861c6be61c105392"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/XO9j68FTWIyPtnWldxUFsot1ftE>

@nibanks 
> there is currently no such requirement that a DDoS mitigation device be stateful. My goal is to have a design where it could be stateless.

Doesn't the mitigation device maintain state so that it could forward handshake, 0-rtt, 1-rtt packets that has certain properties (e.g. 5-tuple, CID)?

Also, IIUC, when multiple retries are involved, the device that issued the first Retry cannot verify the token contained in the second Retry (i.e. the one contained in the third Initial packet sent by the client). 

So I would assume that a DDoS mitigation device (typically the first device to issue a Retry) will be required to create a state for the 5-tuple when it receives the second Initial, and keep forwarding the packets between the client and the server.

Am I missing something?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1649#issuecomment-412551467

[quicwg/base-drafts] Subsequent Initial Packets w… Nick Banks
Re: [quicwg/base-drafts] Subsequent Initial Packe… Martin Thomson
Re: [quicwg/base-drafts] Subsequent Initial Packe… Kazuho Oku
Re: [quicwg/base-drafts] Subsequent Initial Packe… Nick Banks
Re: [quicwg/base-drafts] Subsequent Initial Packe… Kazuho Oku
Re: [quicwg/base-drafts] Subsequent Initial Packe… Nick Banks
Re: [quicwg/base-drafts] Subsequent Initial Packe… Kazuho Oku
Re: [quicwg/base-drafts] Subsequent Initial Packe… Martin Thomson
Re: [quicwg/base-drafts] Subsequent Initial Packe… Martin Thomson
Re: [quicwg/base-drafts] Subsequent Initial Packe… janaiyengar