Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adding a description of the Slowloris attack in security section #448

Merged
merged 8 commits into from Apr 24, 2017
Merged

Adding a description of the Slowloris attack in security section #448

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
48f580c
Update draft-ietf-quic-transport.md
huitema Apr 20, 2017
dec12c2
fixing the slowloris reference.
huitema Apr 20, 2017
bfd754a
Strengthen the SHOULD mitigate text
huitema Apr 20, 2017
f725b84
More punch cards.
huitema Apr 20, 2017
dbdcad8
I thought I was done with punch cards 40 years ago.
huitema Apr 20, 2017
0eeb693
trailing white space.
huitema Apr 20, 2017
6aa8d9e
whatever.
huitema Apr 20, 2017
9dbba10
Punch me.
huitema Apr 20, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
18 changes: 11 additions & 7 deletions draft-ietf-quic-transport.md
View file
Open in desktop
Expand Up @@ -2746,18 +2746,22 @@ packets with ACK frames.

The attacks commonly known as Slowloris {{SLOWLORIS}}
try to keep many connections
to the target endpoint open and hold them open as long as possible. These attacks
to the target endpoint open and hold
them open as long as possible. These attacks
can be executed against a QUIC endpoint by slowly sending small amount of
data on an open stream, slowly opening the flow control windows in order
to limit the sender rate, or possibly manufacturing QUIC ACK that
simulate a high loss rate and slow down sending by the other endpoint.

QUIC implementers should consider implementing the
classic mitigations of the Slowloris attack, such as increasing the maximum
number of clients the server will allow, limiting the number of connections
a single IP address is allowed to make, imposing restrictions on the minimum
transfer speed a connection is allowed to have, and restricting the length of
time a client is allowed to stay connected.
QUIC implementers SHOULD implement
mitigations of the Slowloris attack, such as increasing the maximum
number of clients the server will allow,
limiting the number of connections
a single IP address is allowed to make,
imposing restrictions on the minimum
transfer speed a connection is allowed to have,
and restricting the length of
time an endpoint is allowed to stay connected.

# IANA Considerations

Expand Down