Subject: Re: [quicwg/base-drafts] ACK validation during handshake (#624)

From: Martin Thomson <[email-masked]>
Date: Thu, 31 Aug 2017 04:56:53 +0000 (UTC)

Based on the principles in #645, I propose that we continue to validate ACK frames as normal AND drop the connection if they are invalid.  If an attacker wants to disrupt the connection at this point, they are welcome to do so.

This includes ACK frames that acknowledge packets that were encrypted.  If those arrive in cleartext packets, (a name we should retain even after #693), they are invalid and the connection is bad.  As someone (Ian, I think) pointed out on another thread, at the point you discover that the ACK is bad, you might have processed a bunch of other frames, and backing out changes (particularly to TLS) is very difficult.

Dropping the connection is the most robust response.  It also increases the chances that faults are discovered, absent the Alt-Svc curse.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/624#issuecomment-326189692