Re: [quicwg/base-drafts] Immediately close with INVALID_TOKEN (#3107)

Jana Iyengar <> Sat, 02 November 2019 01:07 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 433011200B9 for <>; Fri, 1 Nov 2019 18:07:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.596
X-Spam-Status: No, score=-6.596 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id B3nMT0FWc95P for <>; Fri, 1 Nov 2019 18:07:44 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 5562212008B for <>; Fri, 1 Nov 2019 18:07:44 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 50951A0089 for <>; Fri, 1 Nov 2019 18:07:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=pf2014; t=1572656863; bh=OKFtosZ5iFhrajiZBPMD/5lszP93um0tJYoVphiHShU=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=JSI5OntEz/4soTujL0FBXNX8NGDvMkfYmv8kA2jrU2Vdq68RYZDfC4BMMPiX+Huy7 2zG7jnapnArxZ86iYXX+Yhld/Xj7AaqbFEgFBZyCWm9xL79KhDth41MkvXEm5GGicC +sYFAEuM1k0aIVHr+vJRsdE7PI36SCP74+YfCfZc=
Date: Fri, 01 Nov 2019 18:07:43 -0700
From: Jana Iyengar <>
Reply-To: quicwg/base-drafts <>
To: quicwg/base-drafts <>
Cc: Subscribed <>
Message-ID: <quicwg/base-drafts/pull/3107/review/>
In-Reply-To: <quicwg/base-drafts/pull/>
References: <quicwg/base-drafts/pull/>
Subject: Re: [quicwg/base-drafts] Immediately close with INVALID_TOKEN (#3107)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5dbcd6df42365_53643fe5038cd96c275e7"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: janaiyengar
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
Archived-At: <>
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 02 Nov 2019 01:07:47 -0000

janaiyengar commented on this pull request.

> @@ -1641,6 +1641,13 @@ of connection establishment.  By giving the client a different connection ID to
 use, a server can cause the connection to be routed to a server instance with
 more resources available for new connections.
+If a server receives a client Initial that can be unprotected but contains an
+invalid Retry token, it knows the client will not accept another Retry token.
+It can either proceed with the handshake without verifying the token or
+immediately close ({{immediate-close}}) the connection with a connection
+error of INVALID_TOKEN to cause the handshake to fail quickly instead of
+waiting for the client to timeout.

It should be possible to detect an invalid token without per-connection state, right? 

That said, I realized that I don't think we should recommend that a server that might be getting DoSsed SHOULD send out another packet in response. How about "A server that is able to maintain enough state MAY either ..."

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub: