Subject: [quicwg/base-drafts] Should connections be disconnected on malformed Initial packets? (#4350)

From: Christian Huitema <[email-masked]>
Date: Thu, 12 Nov 2020 22:09:40 -0800

This issue derives from the efforts of @kazu-yamamoto to write an HTTP3 test suite, and outline potential implementation issues when sticking to the spec. Section 17.2 of the transport spec describes the format of long header packets, and says:

Reserved Bits:
    Two bits (those with a mask of 0x0c) of byte 0 are reserved across multiple packet types. These bits are protected using header protection; see Section 5.4 of [QUIC-TLS]. The value included prior to protection MUST be set to 0. An endpoint MUST treat receipt of a packet that has a non-zero value for these bits after removing both packet and header protection as a connection error of type PROTOCOL_VIOLATION. Discarding such a packet after only removing header protection can expose the endpoint to attacks; see Section 9.5 of [QUIC-TLS].

I can see doing that for Handshake or 0-RTT packets, but for Initial packets that feels risky. Any man-on-the-side can send forged Initial packets, including forged Initial packets with reserved bits set. Do we really intend to say that such packets cause the connection to break? What if the handshake has already progressed?

My gut feeling is that it is simpler and safer to ignore malformed Initial packets and discard them silently.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4350

---

From: Kazuho Oku <[email-masked]>
Date: Thu, 12 Nov 2020 22:48:04 -0800

> My gut feeling is that it is simpler and safer to ignore malformed Initial packets and discard them silently.

IIUC, [the last paragraph of section 21.2](https://quicwg.org/base-drafts/draft-ietf-quic-transport.html#section-21.2-8) allows endpoints to implement such strategy, quote: _Endpoints are permitted to use other methods to detect and attempt to recover from interference with the handshake. Invalid packets may be identified and discarded using other methods, but no specific method is mandated in this document._

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4350#issuecomment-726558306

---

From: Martin Thomson <[email-masked]>
Date: Fri, 13 Nov 2020 00:38:11 -0800

@kazuho has correctly identified the escape hatch we left.  Initial packets are the only place where this really applies, but it goes much further than just those two bits.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4350#issuecomment-726609052

---

From: Peter Doornbosch <[email-masked]>
Date: Fri, 13 Nov 2020 02:46:23 -0800

Are you saying the MUST is not a real MUST because in the "Security Considerations" there is a suggestion that implementations could deviate??? IMHO that would be weird, given emphasis on the meaning of MUST.  

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4350#issuecomment-726693403

---

From: Kazu Yamamoto <[email-masked]>
Date: Mon, 16 Nov 2020 16:09:42 -0800

My opinion is:
- An endpoint MUST send PROTOCOL_VIOLATION for 1-RTT.
- An endpoint MAY send PROTOCOL_VIOLATION or MAY discard the packet for other types.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4350#issuecomment-728467812

---

From: Martin Thomson <[email-masked]>
Date: Tue, 17 Nov 2020 20:57:48 -0800

@kazu-yamamoto, the proposal here is to allow discarding only for Initial.  Other types are effectively authenticated*.

\* Handshake might not be confirmed in the sense that you have key confirmation and peer authentication, but I can't imagine anyone attempting to do anything other than abort if an attacker gets that far).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4350#issuecomment-729408878

---

From: Kazu Yamamoto <[email-masked]>
Date: Wed, 18 Nov 2020 16:34:13 -0800

I'm OK with discarding only Initial.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4350#issuecomment-730045436

---

From: Jana Iyengar <[email-masked]>
Date: Wed, 18 Nov 2020 18:04:53 -0800

Closed #4350 via #4359.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4350#event-4013612078