Subject: [quicwg/base-drafts] Complete version negotiation failure (#1917)

From: Martin Thomson <[email-masked]>
Date: Thu, 25 Oct 2018 13:41:00 -0700

It looks like this:  Client supports A and B only.  Server supports C and D only.  Client sends initial in A (or B), server sends Version Negotiation in response.  Client does what exactly?  Might as well say.

We could get into the client maybe ignoring that because it's an attack, but we decided not to worry too much about that, so probably not worth saying.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1917

---

From: MikkelFJ <[email-masked]>
Date: Thu, 25 Oct 2018 13:54:04 -0700

It's not (generally) an attack and it is a very possible because the much better no-one supports the insecure v1 or v2 anymore (like TLS 1.0, 1.1). Client API returns the equivalent of 501 Not Implemented.

It could of course be an injected packet so the client could wait for something better to show up before failing.

No action required.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1917#issuecomment-433201874

---

From: MikkelFJ <[email-masked]>
Date: Thu, 25 Oct 2018 21:02:56 +0000 (UTC)

" The client MUST choose the version that it most prefers from those supported by the server" ->
or abort the connection attempt with an error indicating that no supported version was available. A client MAY discard such a Version Negotion packet and wait a short while in order to mitigate injection attacks.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1917#issuecomment-433204746

---

From: Martin Thomson <[email-masked]>
Date: Thu, 25 Oct 2018 14:19:34 -0700

Yeah, all I'm looking for here is the "If the client does not support any of the versions the server offers, it aborts the connection attempt." bit you pointed at.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1917#issuecomment-433209636

---

From: MikkelFJ <[email-masked]>
Date: Thu, 25 Oct 2018 14:20:36 -0700

I was about to do a PR, but the text is in your PR

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1917#issuecomment-433209944

---

From: Martin Thomson <[email-masked]>
Date: Thu, 25 Oct 2018 14:22:55 -0700

Yep, I dumped it on top of that pile.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1917#issuecomment-433210569