Found by: 3c.1 (QUIC mimicry) whole-branch review (PR #48).
In bin/yipd/src/quic.rs, run_quic calls endpoint.accept(...) for every inbound QUIC Initial with a new DCID and pushes a ConnEntry with no cap, no Retry/address-validation, and no check against the configured peer set. A flood of spoofed-source / varied-DCID Initials grows the conns Vec without bound → memory exhaustion, and the O(n) linear scans (has_conn_to/find(handle)/find(peer_addr)) degrade to O(n²) per packet.
Not a security break: the inner yip Noise-IK + cert admission still reject any non-peer, so no unauthorized session forms; QUIC Initials must be ≥1200 B, limiting amplification. It's a DoS surface, not a correctness/auth bug.
Why deferred (not a 3c.1 blocker): 3c.1's scope is direct-endpoint peers (not a public-facing server), so the accept surface isn't yet exposed. Accepting arbitrary inbound QUIC is required by the costume/probe-robustness design — only the unboundedness is the gap.
Fix (before 3c.2/3c.3 broaden exposure):
- Cap max concurrent connections; reject/evict beyond it.
- Enable
quinn-proto Retry / address validation on inbound Initials (stateless retry token) so spoofed sources can't cheaply allocate state.
- Prune connections that don't complete the inner yip handshake within a grace window.
- Consider a map (not a Vec) keyed by handle/addr to kill the O(n²) scans.
Belongs with 3c.2 (probe-resistance / fronting) or 3c.3, which is when the QUIC server becomes exposed.
Found by: 3c.1 (QUIC mimicry) whole-branch review (PR #48).
In
bin/yipd/src/quic.rs,run_quiccallsendpoint.accept(...)for every inbound QUIC Initial with a new DCID and pushes aConnEntrywith no cap, no Retry/address-validation, and no check against the configured peer set. A flood of spoofed-source / varied-DCID Initials grows theconnsVec without bound → memory exhaustion, and the O(n) linear scans (has_conn_to/find(handle)/find(peer_addr)) degrade to O(n²) per packet.Not a security break: the inner yip Noise-IK + cert admission still reject any non-peer, so no unauthorized session forms; QUIC Initials must be ≥1200 B, limiting amplification. It's a DoS surface, not a correctness/auth bug.
Why deferred (not a 3c.1 blocker): 3c.1's scope is direct-endpoint peers (not a public-facing server), so the accept surface isn't yet exposed. Accepting arbitrary inbound QUIC is required by the costume/probe-robustness design — only the unboundedness is the gap.
Fix (before 3c.2/3c.3 broaden exposure):
quinn-protoRetry / address validation on inbound Initials (stateless retry token) so spoofed sources can't cheaply allocate state.Belongs with 3c.2 (probe-resistance / fronting) or 3c.3, which is when the QUIC server becomes exposed.