Re: [quicwg/base-drafts] handle reordered NEW_CONNECTION_ID frames (#3202)

Marten Seemann <> Fri, 08 November 2019 03:06 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 7880F12013D for <>; Thu, 7 Nov 2019 19:06:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.596
X-Spam-Status: No, score=-6.596 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id DrxeueSZr38n for <>; Thu, 7 Nov 2019 19:06:21 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 626E012006E for <>; Thu, 7 Nov 2019 19:06:21 -0800 (PST)
Date: Thu, 07 Nov 2019 19:06:20 -0800
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=pf2014; t=1573182380; bh=cbzNEKMaUJdikpUE8JRe2U5qlE7jQQM8WxZ2wRCb+Is=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=uzUqTQpcFnUdXtpjkwB8YgU8lvKUO3CqJ0cDZg6auT32u7D4lCvaFciB8K0MORYXi uaiTbEQrK2F16gm+s3ppSuIn+uAIWHxsAtPJyjrDY79MH24Of8dR11/2Axsd63kiJn Rjfluc5UK1GfjdVjOl5KVd4BYrbWHEu+BexuaZAM=
From: Marten Seemann <>
Reply-To: quicwg/base-drafts <>
To: quicwg/base-drafts <>
Cc: Subscribed <>
Message-ID: <quicwg/base-drafts/pull/3202/>
In-Reply-To: <quicwg/base-drafts/pull/>
References: <quicwg/base-drafts/pull/>
Subject: Re: [quicwg/base-drafts] handle reordered NEW_CONNECTION_ID frames (#3202)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5dc4dbac582bb_26443f8bed6cd960934d1"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: marten-seemann
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
Archived-At: <>
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 08 Nov 2019 03:06:23 -0000

> It might be cleaner to say that when you receive RPT, you need to retire the indicated sequence numbers even if you haven't received them yet. Then you can just discard the NCID frames upon arrival.

@MikeBishop There's a DoS attack here. If the attacker doesn't comply with the rule that new CIDs have to be issued in order (which is one of the non-enforceable MUSTs in the spec) and issues you CID 1000000 while with the same value for Retire Prior To, the endpoint would have to send a million RETIRE_CONNECTION_ID frames. I think the only way to reliable avoid this DoS is to only send RETIRE_CONNECTION_ID for CIDs that you actually received.

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub: