Skip to content

Commit

Permalink
Update draft-ietf-quic-transport.md
Browse files Browse the repository at this point in the history
  • Loading branch information
huitema committed Apr 19, 2017
1 parent c4cad2f commit 12dd1f5
Showing 1 changed file with 8 additions and 4 deletions.
12 changes: 8 additions & 4 deletions draft-ietf-quic-transport.md
Original file line number Diff line number Diff line change
Expand Up @@ -2707,23 +2707,27 @@ attack is in some ways similar to SYN flooding attack in TCP, in which the
attackers try to exhaust a server memory by creating a large number of half
open TCP connections. It is less potent than the SYN flooding attack, since
stream creation is much lighter weight than the creation of TCP-IP connections,
and stream control data presumably requires less memory resource than a TCP protocol
and stream control data presumably requires less
memory resource than a TCP protocol
control block. However, the attack can be amplified if the adversarial
client can open multiple streams with a single message.
Normally, clients will open streams sequentially, as explained in {{stream-identifiers}}.
Normally, clients will open streams sequentially,
as explained in {{stream-identifiers}}.
However, when several streams are initiated at short intervals,
transmission error may cause STREAM DATA frames opening streams to be
received out of sequence. Some implementations will have provisions to
open all intermediate streams in case of out-of-sequence arrival. For example,
a server that receive STREAM DATA for streams 3 and then 9 may decide to
open stream 5 and 7 immediately. An adversarial client would for example exploit that
open stream 5 and 7 immediately. An adversarial client
would for example exploit that
design by sending STREAM DATA for streams 3 and the 2,000,001, causing the
server to open 1 million connections, and contributing to server resource
exhaustion.
The number of active streams is limited by the concurrent stream limit transport
parameter, as explained in {{stream-concurrency}}. If chosen judisciously, this limit
parameter, as explained in {{stream-concurrency}}.
If chosen judisciously, this limit
mitigates the effect of the stream commitment attack. However, setting the limit
too low could affect performance when applications expect to open large number
of streams.
Expand Down

0 comments on commit 12dd1f5

Please sign in to comment.