Re: [quicwg/base-drafts] 5tuple routing (#3536)

[Kazuho Oku <[e-mail]>]

kazuho commented on this pull request.

Generally looks good, though I think there is one issue.

> +
+* Servers can use an out-of-band mechanism to deliver packets to the correct
+destination or transfer state from the original destination. Properly designed,
+this completely solves the problem and no further measures are necessary.
+
+* Sending the disable_active_migration transport parameter informs the client
+that any address change is likely to terminate the connection, which can lead it
+to use more aggressive timeouts or terminate connections when its IP address
+changes.
+
+* The preferred_address transport parameter can provide a path that does not use
+the 5-tuple based routers.
+
+* Servers MUST either use different Stateless Reset Token keys, or encode the
+client IP address and port in the Stateless Reset token. Doing neither will
+create a Reset Oracle (see {{reset-oracle}}).

The last two advices contradict against each other (or are incomplete).

The discussion about the use of preferred_address TP suggests that there is a direct path to any of the servers behind the server cluster, that are reachable from any client address. An attacker might try to use that path to let one of the servers generate a valid stateless token, and send it to the client.

As an example, consider the case of a server cluster consisting of two servers A and B. Server A is handling a connection QUIC connection that goes to client address X. If an attacker might send a packet directly to server B with source address of X, server B would send a valid stateless reset token to X, causing the connection to be reset.

Regarding specification, I think it might be better to simply refer to {{reset-oracle}} regarding the discussion of Stateless Resets, rather than trying to provide an exhaustive list of how to prevent attacks.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-378872391