Re: [quicwg/base-drafts] Disconnect with Initial Injection (#1951)

[MikkelFJ <[e-mail]>]

@marten-seemann  wrote:

> I'm not sure if this is true. Consider the case where a packet contains two ACK frames, the first of which is valid, the second one acknowledges an unsent packet. When processing the frames, you'd first happily process (and clean up your history of sent packets), only to encounter the second, invalid frame. What do you do now? You could unwind the effects of the first ACK frame, which at least in my implementation would a huge amount of complexity, or you could ignore the second ACK frame, accepting the fact that you acted upon a packet that was probably sent by an attacker.

Whatever we do, we need to recognise that this particular case can also be an optimistic ACK attack by a valid endpoint that misbehaves. It is more likely to be a misbehaving client though. Therefore, special casing around this needs to close the connection once handshake encryption is online, but not before. That is a fair bit of complexity right there.


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1951#issuecomment-443327768