Subject: [quicwg/base-drafts] Version negotiation potential amplification issue (#195)

From: ekr <[email-masked]>
Date: Sun, 22 Jan 2017 20:49:25 -0800

If a client sends a packet with an unknown version and a forged source address, it can use it to mount a reflection DoS onto some victim machine. This is only really useful if:

(a) the server has a big version list (so the packet is big)
(b) the server doesn't require the client to pad out to ~1MTU.

Is (b) documented somewhere? The spec suggests that I can send a short packet with a bogus version and the server MUST respond

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/195

---

From: Brian Trammell <[email-masked]>
Date: Mon, 23 Jan 2017 14:36:13 -0800

On (b) see also #136

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/195#issuecomment-274640080

---

From: Martin Thomson <[email-masked]>
Date: Mon, 23 Jan 2017 20:00:56 -0800

Closed #195.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/195#event-933916527

---

From: Martin Thomson <[email-masked]>
Date: Mon, 23 Jan 2017 20:00:56 -0800

Given the requirement for padding the client's packet, let's leave this to #136.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/195#issuecomment-274703948