Tweak non-compliant DCID recommendation about load-balancers HOT 5 CLOSED

For what it's worth, Google's load balancer only uses destination CIDs for routing. We always pick 64bit CIDs during the handshake so we can assume that short headers always carry 64bit CIDs.

from load-balancers.

Do all CIDs resolve to a valid server ID?

from load-balancers.

@DavidSchinazi do you not care about an attacker specifically crafting destination CIDs to attack a particular server?

from load-balancers.

@martinduke

Do all CIDs resolve to a valid server ID?

We do not have a concept of server ID, but yes every CID routes to a server.

@nibanks

@DavidSchinazi do you not care about an attacker specifically crafting destination CIDs to attack a particular server?

We do not care about that attack. I haven't seen any indication that it can actually cause harm in real life.

from load-balancers.

@DavidSchinazi very well, then you have no non-compliant DCIDs. You would only need to upgrade your LBs for new versions if they allowed client-chosen DCIDs < 8 bytes.

from load-balancers.