Date: Tue, 03 Jul 2018 19:25:29 -0700
From: Kazuho Oku <notifications@github.com>
Reply-To: quicwg/base-drafts
 <reply+0166e4ab3f4fc824046b05c299231c0ba203af389ef547bc92cf000000011753f21992a169ce140801b8@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/1486/402344343@github.com>
In-Reply-To: <quicwg/base-drafts/issues/1486@github.com>
References: <quicwg/base-drafts/issues/1486@github.com>
Subject: Re: [quicwg/base-drafts] Client's initial destination CID is
 unauthenticated (#1486)
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--==_mimepart_5b3c30191e059_fab3fb5d1a08f7c168272";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/yy1w032m6URjvozoEg6JDi1uqYM>


----==_mimepart_5b3c30191e059_fab3fb5d1a08f7c168272
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

@janaiyengar 
> but I wonder if the ability to have all connections target specific CIDs might allow some sort of interesting attacks via steering the server's load balancing infrastructure.

I do not think that providing middleboxes the ability change the DCID opens up a _new_ attack vector, because load balancers need to take care of DoS attacks *mounted by clients* using specific DCID (or set of specific DCIDs) anyways.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1486#issuecomment-402344343
----==_mimepart_5b3c30191e059_fab3fb5d1a08f7c168272
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p><a class=3D"user-mention" data-hovercard-user-id=3D"11067604" data-oct=
o-click=3D"hovercard-link-click" data-octo-dimensions=3D"link_type:self" =
href=3D"https://github.com/janaiyengar">@janaiyengar</a></p>
<blockquote>
<p>but I wonder if the ability to have all connections target specific CI=
Ds might allow some sort of interesting attacks via steering the server's=
 load balancing infrastructure.</p>
</blockquote>
<p>I do not think that providing middleboxes the ability change the DCID =
opens up a <em>new</em> attack vector, because load balancers need to tak=
e care of DoS attacks <em>mounted by clients</em> using specific DCID (or=
 set of specific DCIDs) anyways.</p>

<p style=3D"font-size:small;-webkit-text-size-adjust:none;color:#666;">&m=
dash;<br />You are receiving this because you are subscribed to this thre=
ad.<br />Reply to this email directly, <a href=3D"https://github.com/quic=
wg/base-drafts/issues/1486#issuecomment-402344343">view it on GitHub</a>,=
 or <a href=3D"https://github.com/notifications/unsubscribe-auth/AWbkq6IW=
KbtCY2J7JcPK1Gc00K55H3zaks5uDCeZgaJpZM4U5BQ4">mute the thread</a>.<img sr=
c=3D"https://github.com/notifications/beacon/AWbkq9dPnLjj7m5No1aH1znb2vof=
GBn6ks5uDCeZgaJpZM4U5BQ4.gif" height=3D"1" width=3D"1" alt=3D"" /></p>
<script type=3D"application/json" data-scope=3D"inboxmarkup">{"api_versio=
n":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name"=
:"GitHub"},"entity":{"external_key":"github/quicwg/base-drafts","title":"=
quicwg/base-drafts","subtitle":"GitHub repository","main_image_url":"http=
s://assets-cdn.github.com/images/email/message_cards/header.png","avatar_=
image_url":"https://assets-cdn.github.com/images/email/message_cards/avat=
ar.png","action":{"name":"Open in GitHub","url":"https://github.com/quicw=
g/base-drafts"}},"updates":{"snippets":[{"icon":"PERSON","message":"@kazu=
ho in #1486: @janaiyengar \r\n\u003e but I wonder if the ability to have =
all connections target specific CIDs might allow some sort of interesting=
 attacks via steering the server's load balancing infrastructure.\r\n\r\n=
I do not think that providing middleboxes the ability change the DCID ope=
ns up a _new_ attack vector, because load balancers need to take care of =
DoS attacks *mounted by clients* using specific DCID (or set of specific =
DCIDs) anyways."}],"action":{"name":"View Issue","url":"https://github.co=
m/quicwg/base-drafts/issues/1486#issuecomment-402344343"}}}</script>
<script type=3D"application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/quicwg/base-drafts/issues/1486#issuecomment=
-402344343",
"url": "https://github.com/quicwg/base-drafts/issues/1486#issuecomment-40=
2344343",
"name": "View Issue"
},
"description": "View this Issue on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
},
{
"@type": "MessageCard",
"@context": "http://schema.org/extensions",
"hideOriginalBody": "false",
"originator": "AF6C5A86-E920-430C-9C59-A73278B5EFEB",
"title": "Re: [quicwg/base-drafts] Client's initial destination CID is un=
authenticated (#1486)",
"sections": [
{
"text": "",
"activityTitle": "**Kazuho Oku**",
"activityImage": "https://assets-cdn.github.com/images/email/message_card=
s/avatar.png",
"activitySubtitle": "@kazuho",
"facts": [

]
}
],
"potentialAction": [
{
"name": "Add a comment",
"@type": "ActionCard",
"inputs": [
{
"isMultiLine": true,
"@type": "TextInput",
"id": "IssueComment",
"isRequired": false
}
],
"actions": [
{
"name": "Comment",
"@type": "HttpPOST",
"target": "https://api.github.com",
"body": "{\n\"commandName\": \"IssueComment\",\n\"repositoryFullName\": \=
"quicwg/base-drafts\",\n\"issueId\": 1486,\n\"IssueComment\": \"{{IssueCo=
mment.value}}\"\n}"
}
]
},
{
"name": "Close issue",
"@type": "HttpPOST",
"target": "https://api.github.com",
"body": "{\n\"commandName\": \"IssueClose\",\n\"repositoryFullName\": \"q=
uicwg/base-drafts\",\n\"issueId\": 1486\n}"
},
{
"targets": [
{
"os": "default",
"uri": "https://github.com/quicwg/base-drafts/issues/1486#issuecomment-40=
2344343"
}
],
"@type": "OpenUri",
"name": "View on GitHub"
},
{
"name": "Unsubscribe",
"@type": "HttpPOST",
"target": "https://api.github.com",
"body": "{\n\"commandName\": \"MuteNotification\",\n\"threadId\": 3504917=
04\n}"
}
],
"themeColor": "26292E"
}
]</script>=

----==_mimepart_5b3c30191e059_fab3fb5d1a08f7c168272--