Subject: [quicwg/base-drafts] Require the client to detect partly bogus version negotiation packets (#593)

From: ekr <[email-masked]>
Date: Tue, 06 Jun 2017 05:30:30 -0700

in which the server sends back the client's version, as servers
aren't supposed to do this.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/593

-- Commit Summary --

  * Require the client to detect partly bogus version negotiation packets

-- File Changes --

    M draft-ietf-quic-transport.md (5)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/593.patch
https://github.com/quicwg/base-drafts/pull/593.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/593

---

From: Martin Thomson <[email-masked]>
Date: Tue, 06 Jun 2017 05:34:43 -0700

martinthomson commented on this pull request.

> @@ -933,7 +933,10 @@ proceeds with the handshake ({{handshake}}).  This commits the server to the
 version that the client selected.
 
 When the client receives a Version Negotiation packet from the server, it should
-select an acceptable protocol version.  If the server lists an acceptable
+select an acceptable protocol version. If the packet contains the version that
+the client initially offered, the client MUST terminate the connection
+using a QUIC_INVALID_VERSION_NEGOTIATION_PACKET error.

It's not currently possible to send that error code.  (See #467.)

It might be better to just consider QUIC to have failed in this case.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/593#pullrequestreview-42298466

---

From: Mike Bishop <[email-masked]>
Date: Wed, 07 Jun 2017 07:03:46 -0700

I'm not clear why this is an improvement.  We currently have:

> A client MUST ignore a Version Negotiation packet that lists the client’s chosen version.

If we define a packet which causes us to just bail, it becomes very easy to disrupt handshakes by packet injection.  Whereas ignoring the potentially-malicious packet and waiting for a timeout gives a chance to succeed.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/593#issuecomment-306804580

---

From: ekr <[email-masked]>
Date: Wed, 07 Jun 2017 07:20:03 -0700

I had missed that line.

With that said, I think we want a general defense against packet injection
(cf. https://github.com/quicwg/base-drafts/issues/554)

On Wed, Jun 7, 2017 at 4:03 PM, Mike Bishop <[email-masked]>
wrote:

> If we define a packet which causes us to just bail, it becomes very easy
> to disrupt handshakes by packet injection. Whereas ignoring the
> potentially-malicious packet and waiting for a timeout gives a chance to
> succeed.
>
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub
> <https://github.com/quicwg/base-drafts/pull/593#issuecomment-306804580>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/ABD1oZ5P51nan0KEg23vDErw93l5PN3Pks5sBq3AgaJpZM4NxRkj>
> .
>

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/593#issuecomment-306809586