Subject: [quicwg/base-drafts] Version negotation should only be sent for initial client packets (#603)

From: MikkelFJ <[email-masked]>
Date: Wed, 07 Jun 2017 03:24:08 -0700

Quote from draft-03 section 7.1:

> When the server receives a packet from a client with the long header format, it compares the client’s version to the versions it supports.
If the version selected by the client is not acceptable to the server, the server discards the incoming packet and responds with a Version Negotiation packet (Section 5.3). This includes a list of versions that the server will accept.
A server sends a Version Negotiation packet for every packet that it receives with an unacceptable version. This allows a server to process packets with unsupported versions without retaining state. Though either the initial client packet or the version negotiation packet that is sent in response could be lost, the client will send new packets until it successfully receives a response.

Later text protects against false version negotiation packets, but there is no reason for a server to respond with a version negotion packet for anything other than an initial packet, which is required to min PMTU sized. Rather, the server ought to drop packets with wrong versions in this case.

Mentioned as a related  topic here:
https://github.com/quicwg/base-drafts/issues/599#issuecomment-306747908

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/603

---

From: MikkelFJ <[email-masked]>
Date: Wed, 07 Jun 2017 04:33:44 -0700

Related: I cannot readily find any text that says how to handle packet with an invalid version in its header, except where a server issues a version negotation packet.

I suggest any packet received with an invalid version should be ignored, except for client initial packet. If not, an adversary could jam a connection with invalid packet versions.

Stateless retry packets do not state which version to list - I suggest mirroring the client version - or require version negotiation to take place first.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/603#issuecomment-306768158

---

From: Martin Thomson <[email-masked]>
Date: Wed, 07 Jun 2017 07:06:37 -0700

Closed #603.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/603#event-1113720749

---

From: Martin Thomson <[email-masked]>
Date: Wed, 07 Jun 2017 07:06:37 -0700

Duplicate of #570.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/603#issuecomment-306805474