{"action":"created","issue":{"url":"https://api.github.com/repos/quicwg/base-drafts/issues/377","repository_url":"https://api.github.com/repos/quicwg/base-drafts","labels_url":"https://api.github.com/repos/quicwg/base-drafts/issues/377/labels{/name}","comments_url":"https://api.github.com/repos/quicwg/base-drafts/issues/377/comments","events_url":"https://api.github.com/repos/quicwg/base-drafts/issues/377/events","html_url":"https://github.com/quicwg/base-drafts/issues/377","id":212940357,"number":377,"title":"ICMP and ICMPv6 (Type: DestinationUnreachable)","user":{"login":"igorlord","id":25256216,"avatar_url":"https://avatars3.githubusercontent.com/u/25256216?v=3","gravatar_id":"","url":"https://api.github.com/users/igorlord","html_url":"https://github.com/igorlord","followers_url":"https://api.github.com/users/igorlord/followers","following_url":"https://api.github.com/users/igorlord/following{/other_user}","gists_url":"https://api.github.com/users/igorlord/gists{/gist_id}","starred_url":"https://api.github.com/users/igorlord/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/igorlord/subscriptions","organizations_url":"https://api.github.com/users/igorlord/orgs","repos_url":"https://api.github.com/users/igorlord/repos","events_url":"https://api.github.com/users/igorlord/events{/privacy}","received_events_url":"https://api.github.com/users/igorlord/received_events","type":"User","site_admin":false},"labels":[{"id":481871361,"url":"https://api.github.com/repos/quicwg/base-drafts/labels/design","name":"design","color":"1d76db","default":false},{"id":481871399,"url":"https://api.github.com/repos/quicwg/base-drafts/labels/transport","name":"transport","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-03-09T05:40:06Z","updated_at":"2017-03-09T05:49:08Z","closed_at":null,"body":"This is related to #353.\r\n\r\nWhat would we expect endpoints to do upon the receipt of ICMP (or ICMPv6) Type=DestinationUnreachable?  For IPv6, that message has a large chunk of the original packet, proving that a path element sent it. For IPv4, there is very little entropy there (just your src port).\r\n\r\nCan this be as trusted as PUBLIC_RESET by Clients? For IPv4 the answer is likely to be \"no\". For ipv6, I am not that sure. But there are real implications for clients that cannot just fall back to tcp.\r\n\r\nIf you ignore ICMP and keep retrying the dead server, you are very likely missing an opportunity to switch the server (switch to another IP offered by DNS).\r\n\r\nIf you do not ignore ICMP (especially ICMPv4) and try reopening the connection (using a different server IP), you are allowing using your client in a highly amplified reflection DDOS attack against the sever. The attacker just needs to send you a slow stream of forged ICMP to get you to keep re-opening/re-negotiating connections and retrying expensive requests."},"comment":{"url":"https://api.github.com/repos/quicwg/base-drafts/issues/comments/285260996","html_url":"https://github.com/quicwg/base-drafts/issues/377#issuecomment-285260996","issue_url":"https://api.github.com/repos/quicwg/base-drafts/issues/377","id":285260996,"user":{"login":"martinthomson","id":67641,"avatar_url":"https://avatars2.githubusercontent.com/u/67641?v=3","gravatar_id":"","url":"https://api.github.com/users/martinthomson","html_url":"https://github.com/martinthomson","followers_url":"https://api.github.com/users/martinthomson/followers","following_url":"https://api.github.com/users/martinthomson/following{/other_user}","gists_url":"https://api.github.com/users/martinthomson/gists{/gist_id}","starred_url":"https://api.github.com/users/martinthomson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinthomson/subscriptions","organizations_url":"https://api.github.com/users/martinthomson/orgs","repos_url":"https://api.github.com/users/martinthomson/repos","events_url":"https://api.github.com/users/martinthomson/events{/privacy}","received_events_url":"https://api.github.com/users/martinthomson/received_events","type":"User","site_admin":false},"created_at":"2017-03-09T05:49:08Z","updated_at":"2017-03-09T05:49:08Z","body":"We really need to be careful not to conflate \"path dead\" signals like this (their authenticity aside), with \"connection dead\" signals like Public Reset.\r\n\r\nWe could use the same advice we have for PMTUD: treat these packets with a degree of suspicion."}}
{"actor":{"display_login":"martinthomson"}}