Re: [quicwg/base-drafts] Defend against endless Stateless Reset ping-pong (#1627)

[Kazuho Oku <[e-mail]>]

kazuho commented on this pull request.



> @@ -2669,7 +2671,36 @@ the same static key (see {{reset-oracle}}).  A connection ID from a connection
 that is reset by revealing the Stateless Reset Token cannot be reused for new
 connections at nodes that share a static key.
 
-Note that Stateless Reset messages do not have any cryptographic protection.
+Note that Stateless Reset packets do not have any cryptographic protection.
+
+
+#### Looping {#reset-looping}
+
+The design of a Stateless Reset is such that it is indistinguishable from a
+valid packet.  This means that a Stateless Reset might trigger the sending of a
+Stateless Reset in response, which could lead to infinite exchanges.  An
+endpoint MUST use any one of the following measures to limit the sending of
+Stateless Reset:
+
+* An endpoint can remember the number of Stateless Reset packets that it has
+  sent and stop generating new Stateless Reset packets once a limit is reached.
+  Using separate limits for different remote addresses will ensure that

Would it make sense to suggest "using separate limits" for different DCIDs of the incoming packets in addition to "remote addresses"?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1627#pullrequestreview-142252667