Subject: [quicwg/base-drafts] Server enforcement of 1280 octet packet size (#267)

From: Martin Thomson <[email-masked]>
Date: Tue, 07 Feb 2017 20:21:50 -0800

PR #106 added the following requirement on servers:

> Servers MUST reject the first plaintext packet received from a client if it its total size is less than 1280 octets, to mitigate amplification attacks.

However, this runs into an issue in the case where there are IP header extensions that the client knows about but the server doesn't.  If the client is aware of the IP header extensions and constructs a packet with a smaller payload in order to comply with our recommendation to create a packet of exactly 1280 octets, the server will receive a packet that it thinks is too small.

I see a few options:
1. loosen the enforcement constraint on the server
2. specify that the server only enforce the constraint if it sees the entire IP packet
3. specify the minimum size and its enforcement in terms of payload size (we could set different values here to allow for header extensions)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/267

---

From: Ryan Hamilton <[email-masked]>
Date: Tue, 07 Feb 2017 20:49:20 -0800

I would be inclined to go with #3. The UDP payload of the first plaintext
packet from a client to a server must be at least 1280 bytes.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/267#issuecomment-278228541

---

From: Martin Thomson <[email-masked]>
Date: Tue, 07 Feb 2017 20:53:09 -0800

We could split by version so that the IP datagram is closer to 1280, i.e., 1232 octets for IPv6 and 1252 octets for IPv4.  Then we hit 1280 in the absence of header extensions.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/267#issuecomment-278228916