Ignore Version Negotiation if it was already done

[martinthomson]

The text currently says:

Once a client receives a packet from the server with the VERSION flag unset, it MUST ignore the flag in subsequently received packets.

I don't know how to interpret this. What should a client do if it receives a packet with the VERSION flag set after completing version negotiation? Maybe should should mandate ignoring the packet not just the flag.

[marten-seemann]

Ignoring the packet is the correct behavior, and is what current implementations do.
Otherwise it would be easy for an attacker to interfere with a connection, since version negotiation packets are not authenticated.

[RyanTheOptimist]

That text is definitely unclear. What it's trying to say, is that after the client and server have negotiated a version, the client needs to ignore any version negotiation packets its receives. This is because 0-RTT packets sent with the old version may have elicited version negotiation packets which may end up delivered out of order.

[martinthomson]

It probably needs to go further and recommend that the client not change its mind more than once. That is, if it receives a version negotiation packet that would cause it to select a third version, that's reason enough to ignore the packet.