Subject: [quicwg/base-drafts] Count entire datagram for anti-amplification (#3470)

From: Lucas Pardue <[email-masked]>
Date: Tue, 18 Feb 2020 16:10:52 -0800

Creating PR on behalf of @martinthomson. This is a tweak to the text suggested in #3333.

Closes #3333.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/3470

-- Commit Summary --

  * Count entire datagram for anti-amplification

-- File Changes --

    M draft-ietf-quic-transport.md (7)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/3470.patch
https://github.com/quicwg/base-drafts/pull/3470.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3470

---

From: ianswett <[email-masked]>
Date: Mon, 24 Feb 2020 13:25:20 -0800

ianswett approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3470#pullrequestreview-363711473

---

From: David Schinazi <[email-masked]>
Date: Tue, 25 Feb 2020 11:07:11 -0800

DavidSchinazi approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3470#pullrequestreview-364373225

---

From: Mike Bishop <[email-masked]>
Date: Wed, 26 Feb 2020 06:53:02 -0800

MikeBishop approved this pull request.

> @@ -1625,8 +1625,11 @@ consider the client address to have been validated.
 Prior to validating the client address, servers MUST NOT send more than three
 times as many bytes as the number of bytes they have received.  This limits the
 magnitude of any amplification attack that can be mounted using spoofed source
-addresses.  In determining this limit, servers only count the size of
-successfully processed packets.
+addresses.  For the purposes of avoiding amplification prior to address
+validation, servers MUST count all of the payload bytes received in datagrams
+that are uniquely attributed to a single connection. This includes datagrams

This feels a little duplicative, but the emphasis might be appropriate.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3470#pullrequestreview-364963348