Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid tracking bits in Alt-Svc quic= parameter #1081

Closed
MikeBishop opened this issue Jan 29, 2018 · 2 comments
Closed

Avoid tracking bits in Alt-Svc quic= parameter #1081

MikeBishop opened this issue Jan 29, 2018 · 2 comments
Labels
-http design An issue that affects the design of the protocol; resolution requires consensus.

Comments

@MikeBishop
Copy link
Contributor

If a server sends an Alt-Svc entry that nominates a QUIC version that doesn't actually exist and the client goes with it, there's a tracking risk. The client should never propose a valid version that it doesn't speak, so this isn't 32 bits of tracking, but if the server sends something in the grease range, the client knows it's okay that it doesn't speak it. You still get 16 bits of persistent ID this way.

This can probably be avoided by adding a requirement that the client only use versions from the list that it speaks, and that if it decides to grease it MUST generate its own grease version.

@martinthomson
Copy link
Member

Note that the greasing point is moot. No implementation should ever consider itself to understand one of the reserved versions.

@MikeBishop
Copy link
Contributor Author

Mostly resolved by #1097, which requires the client to drop reserved versions.

@mnot mnot added the design An issue that affects the design of the protocol; resolution requires consensus. label Mar 5, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
-http design An issue that affects the design of the protocol; resolution requires consensus.
Projects
None yet
Development

No branches or pull requests

3 participants