[Masque] TTL and infinite QUIC-proxy loops

[Martin Duke <[e-mail]>]

(Looking forward to not having to say "with no hats" in 4 months).

In my presentation in Prague on infinite quic-proxy loops, I dismissed the
idea that simply decrementing the TTL was a sufficient mitigation for
infinite loops caused by a misbehaving client, because 256 hops is still a
lot. In response, Ted suggested that we could use a lower limit.

Thankfully, we did not try to further design this at the mic.

But, thinking about it some more, Ted's suggestion could mean two things:

(1) Use the IP TTL field: "When receiving a packet from the target, a proxy
MUST set the TTL on the forwarded packet's IP header to a value lower than
the TTL value of the incoming IP header. Furthermore, the TTL value MUST be
no larger than N".

Clearly, for some value of N the mitigation would be sufficient. I have not
checked if this in some way violates the rules about IP TTL. I also wonder
if a hard limit is sufficiently permissive for legitimate but long paths.

(2) There is some sort of MASQUE field that counts down the number of proxy
hops. I cannot see how this can work, as (a) these are packets from the
target, which is not going to add MASQUE-specific stuff; (b) by design,
proxies do not know if targets are also MASQUE proxies; and (c) by design,
proxies to do not know if clients are MASQUE proxies.

*****

I do not object to decrementing the IP TTL field by one in forwarded mode,
though I think that is an insufficient mitigation for this attack. If
anyone has a better-thought out design to enforce a limit, or thinks that
256 hops is just fine, I would appreciate their input.

Martin