Date: Wed, 07 Jun 2017 07:03:46 -0700
From: Mike Bishop <notifications@github.com>
Reply-To: quicwg/base-drafts
 <reply+0166e4abe02af2f7b991b4c36672a21bc3f5e8ca605c267692cf00000001154fc9c292a169ce0df0aa66@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/pull/593/c306804580@github.com>
In-Reply-To: <quicwg/base-drafts/pull/593@github.com>
References: <quicwg/base-drafts/pull/593@github.com>
Subject: Re: [quicwg/base-drafts] Require the client to detect partly bogus
 version negotiation packets (#593)
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--==_mimepart_593807c2153ef_52103fa416b4dc38582ea";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/zlEbPOH-SwVfRSwFNIVG9z6pR-k>

----==_mimepart_593807c2153ef_52103fa416b4dc38582ea
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: quoted-printable

I'm not clear why this is an improvement.  We currently have:

> A client MUST ignore a Version Negotiation packet that lists the client=
=E2=80=99s chosen version.

If we define a packet which causes us to just bail, it becomes very easy to=
 disrupt handshakes by packet injection.  Whereas ignoring the potentially-=
malicious packet and waiting for a timeout gives a chance to succeed.


--=20
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/593#issuecomment-306804580=

----==_mimepart_593807c2153ef_52103fa416b4dc38582ea
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p>I'm not clear why this is an improvement.  We currently have:</p>
<blockquote>
<p>A client MUST ignore a Version Negotiation packet that lists the client=
=E2=80=99s chosen version.</p>
</blockquote>
<p>If we define a packet which causes us to just bail, it becomes very easy=
 to disrupt handshakes by packet injection.  Whereas ignoring the potential=
ly-malicious packet and waiting for a timeout gives a chance to succeed.</p>

<p style=3D"font-size:small;-webkit-text-size-adjust:none;color:#666;">&mda=
sh;<br />You are receiving this because you are subscribed to this thread.<=
br />Reply to this email directly, <a href=3D"https://github.com/quicwg/bas=
e-drafts/pull/593#issuecomment-306804580">view it on GitHub</a>, or <a href=
=3D"https://github.com/notifications/unsubscribe-auth/AWbkq3o6Kj9DW1iTMnOm4=
IWMdpeFQyxWks5sBq3CgaJpZM4NxRkj">mute the thread</a>.<img alt=3D"" height=
=3D"1" src=3D"https://github.com/notifications/beacon/AWbkqzFXh7N0e5CFRUCdb=
q0ZIDwVYzmoks5sBq3CgaJpZM4NxRkj.gif" width=3D"1" /></p>
<div itemscope itemtype=3D"http://schema.org/EmailMessage">
<div itemprop=3D"action" itemscope itemtype=3D"http://schema.org/ViewAction=
">
  <link itemprop=3D"url" href=3D"https://github.com/quicwg/base-drafts/pull=
/593#issuecomment-306804580"></link>
  <meta itemprop=3D"name" content=3D"View Pull Request"></meta>
</div>
<meta itemprop=3D"description" content=3D"View this Pull Request on GitHub"=
></meta>
</div>

<script type=3D"application/json" data-scope=3D"inboxmarkup">{"api_version"=
:"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name":"Gi=
tHub"},"entity":{"external_key":"github/quicwg/base-drafts","title":"quicwg=
/base-drafts","subtitle":"GitHub repository","main_image_url":"https://clou=
d.githubusercontent.com/assets/143418/17495839/a5054eac-5d88-11e6-95fc-7290=
892c7bb5.png","avatar_image_url":"https://cloud.githubusercontent.com/asset=
s/143418/15842166/7c72db34-2c0b-11e6-9aed-b52498112777.png","action":{"name=
":"Open in GitHub","url":"https://github.com/quicwg/base-drafts"}},"updates=
":{"snippets":[{"icon":"PERSON","message":"@MikeBishop in #593: I'm not cle=
ar why this is an improvement.  We currently have:\r\n\r\n\u003e A client M=
UST ignore a Version Negotiation packet that lists the client=E2=80=99s cho=
sen version.\r\n\r\nIf we define a packet which causes us to just bail, it =
becomes very easy to disrupt handshakes by packet injection.  Whereas ignor=
ing the potentially-malicious packet and waiting for a timeout gives a chan=
ce to succeed.\r\n"}],"action":{"name":"View Pull Request","url":"https://g=
ithub.com/quicwg/base-drafts/pull/593#issuecomment-306804580"}}}</script>=

----==_mimepart_593807c2153ef_52103fa416b4dc38582ea--