Handshake timeout for iQUIC connections

[Stanislav Slusny]

Hi,

I have a question on the behavior of idle timeout during the handshake.
As the value of idle timeout is included in transport parameters, it is negotiated during the handshake.

For IETF QUIC, the negotiated value is applied immediately as the transport parameters are parsed, which happens just after the ClientHello has been received, see
https://quiche.googlesource.com/quiche/+/refs/heads/main/quiche/quic/core/quic_connection.cc#393

So the QUICHE does not apply the "handshake timeout" for iQUIC connections, as opposed to gQUIC connections. The functionality is implemented in QUICHE, but it is not utilized for iQUIC connections. Is this the intended behavior ?

It might be valuable to look at "half-open" connections in a different way than on fully established connections, and apply the smaller handshake timeout (as in gQUIC).
The concern might be a DOS attack, if the application limits the number of "half-open" connections. The source address does not have to be validated at this stage and server-side Retry is not yet supported in QUICHE library. It is probably not difficult to generate single ClientHello messages for attackers.

Is it left for the application to implement such behavior, or don't you see it as a valid concern and the handshake timeout might disappear from QUICHE in the future ? 

Thanks,

Stanislav Slusny