Re: [quicwg/base-drafts] Disconnect with Initial Injection (#1951)

[Marten Seemann <[e-mail]>]

> The rules are easier to implement than what we have now in #2053, because the rules can be applied in one-path, rather than in two-pass (i.e. first check that the frames are valid then apply all of them).

I don't think that's true. Consider the case where a packet contains two ACK frames, the first of which is valid, the second one acknowledges an unsent packet. When processing the frames, you'd first happily process (and clean up your history of sent packets), only to encounter the second, invalid frame. What do you do now? You *could* unwind the effects of the first ACK frame, which at least in my implementation would a huge amount of complexity, or you could ignore the second ACK frame, accepting the fact that you acted upon a packet that was probably sent by an attacker.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1951#issuecomment-443074692