Re: [quicwg/base-drafts] What needs to be checked for address validation (#3327)

[ekr <[e-mail]>]

ekr commented on this pull request.



> @@ -1834,9 +1834,18 @@ SHOULD include information that allows the server to verify that the source IP
 address and port in client packets remains constant.
 
 Servers might use tokens from NEW_TOKEN in deciding not to send a Retry packet,
-even if the client address has changed. Tokens sent in NEW_TOKEN frames SHOULD
-include information that allows the server to verify if the client address is
-stable, but might allow for different NAT bindings or ephemeral port selection.
+even if the client address has changed. Tokens sent in NEW_TOKEN frames MUST
+include information that allows the server to verify that the client IP address
+has not changed from when the token was issued.

I think this text would be a lot clearer if you moved the first sentence to the end and wrote it as:

"Servers might use tokens from NEW_TOKEN in deciding not to send a Retry packet,
even if the client address has changed. However, if the address has changed, the
server MUST adhere to the anti-amplification limits found in XXX"

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3327#pullrequestreview-359895222