Re: DoS-ing QUIC servers is too easy

[Ian Swett <[e-mail]>]

On Fri, Jul 19, 2019 at 12:04 PM Willy Tarreau <[e-mail]> wrote:

> Hi Ian,
>
> On Fri, Jul 19, 2019 at 11:31:26AM -0400, Ian Swett wrote:
> > QUIC's Retry token is designed for this purpose.  I believe that should
> be
> > sufficient and make QUIC equivalent to TCP.
>
> The important difference is that only the QUIC stack can process this,
> so the packet has to pass all the way through the whole stack to userland,
> the protection cannot be offloaded to lower layers nor to an external
> device. This remains a pretty big concern to me.
>

There's a proposed draft(draft-duke-quic-load-balancers
<https://datatracker.ietf.org/doc/draft-duke-quic-load-balancers/>) on QUIC
load balancers, so I don't think the above is necessarily true.

>
> > Also, QUIC requires much larger Initial packet sizes than a TCP SYN,
> > increasing the amount of work an attacker has to expend.
>
> Sure but not that much. Even with an initial packet as large as 200 bytes
> you still feed the whole stack at 5 million packets per second on a single
> 10G port. This is a lot to pass through the whole stack, not counting the
> potential crypto that is associated with it nor building the response, of
> course. But we'll see.
>
>
The minimum is 1200 bytes FYI.

> Willy
>