Re: [Masque] TTL and infinite QUIC-proxy loops

On Wed, Nov 15, 2023 at 11:54 AM Martin Duke <martin.h.duke@gmail.com>
wrote:

> (Looking forward to not having to say "with no hats" in 4 months).
>
> In my presentation in Prague on infinite quic-proxy loops, I dismissed the
> idea that simply decrementing the TTL was a sufficient mitigation for
> infinite loops caused by a misbehaving client, because 256 hops is still a
> lot. In response, Ted suggested that we could use a lower limit.
>
> Thankfully, we did not try to further design this at the mic.
>
> But, thinking about it some more, Ted's suggestion could mean two things:
>
> (1) Use the IP TTL field: "When receiving a packet from the target, a
> proxy MUST set the TTL on the forwarded packet's IP header to a value lower
> than the TTL value of the incoming IP header. Furthermore, the TTL value
> MUST be no larger than N".
>
> Clearly, for some value of N the mitigation would be sufficient. I have
> not checked if this in some way violates the rules about IP TTL. I also
> wonder if a hard limit is sufficiently permissive for legitimate but long
> paths.
>
> (2) There is some sort of MASQUE field that counts down the number of
> proxy hops. I cannot see how this can work, as (a) these are packets from
> the target, which is not going to add MASQUE-specific stuff; (b) by design,
> proxies do not know if targets are also MASQUE proxies; and (c) by design,
> proxies to do not know if clients are MASQUE proxies.
>
> *****
>
> I do not object to decrementing the IP TTL field by one in forwarded mode,
> though I think that is an insufficient mitigation for this attack. If
> anyone has a better-thought out design to enforce a limit, or thinks that
> 256 hops is just fine, I would appreciate their input.
>
This is what I assumed we were talking about on the previous thread on the
list, and what my suggestion of TTL decrementing was based on.

>
> Martin
> --
> Masque mailing list
> Masque@ietf.org
> https://www.ietf.org/mailman/listinfo/masque
>