Subject: streamid attack

From: Jiuhai Zhang <[email-masked]>
Date: Thu, 2 Jan 2020 21:33:02 +0800

In 2.1. Stream Types and Identifiers
A stream ID that is used out of order results in all streams of that type
with lower-numbered stream IDs also being opened.

Attacker can send a stream frame with a large streamid, then server will
open a lot of streams. How to avoid this besides flow control? Why we
should open lower-numbered stream IDs?

---

From: Ian Swett <[email-masked]>
Date: Thu, 2 Jan 2020 09:55:58 -0500

This is avoided by limiting the number of open streams with MAX_STREAMS.
If you're willing to let the peer open a certain number of streams, the
only 'attack' is that it's lower cost to do it with a single frame.

I'll note there are ways to reduce the state associated with these 'open',
but not yet referenced streams to a few bytes(ie: a hashmap entry), and
that sort of accounting would have to be done whether you consider them
open or closed.

I believe it made some implementations simpler to assume they were opened
once a higher number was referenced, but I don't have a link to the
relevant issue on hand at the moment.