Re: DoS-ing QUIC servers is too easy

[Willy Tarreau <[e-mail]>]

Hi Ian,

On Fri, Jul 19, 2019 at 01:47:19PM -0400, Ian Swett wrote:
> There's a proposed draft(draft-duke-quic-load-balancers
> <https://datatracker.ietf.org/doc/draft-duke-quic-load-balancers/>) on QUIC
> load balancers, so I don't think the above is necessarily true.

Yes, as mentioned in my other message I've already seen this one.

> > > Also, QUIC requires much larger Initial packet sizes than a TCP SYN,
> > > increasing the amount of work an attacker has to expend.
> >
> > Sure but not that much. Even with an initial packet as large as 200 bytes
> > you still feed the whole stack at 5 million packets per second on a single
> > 10G port. This is a lot to pass through the whole stack, not counting the
> > potential crypto that is associated with it nor building the response, of
> > course. But we'll see.
> >
> >
> The minimum is 1200 bytes FYI.

My understanding was that it was the minimum supported so that it should
be the maximum used by clients. i.e. a valid initial packet can be much
smaller than this. But I could be mistaken as I've had a hard time keeping
up with the progress made on the protocol.

Thanks,
Willy