[quicwg/base-drafts] Avoid attack on address validation during connection migration (#746)

[Martin Thomson <[e-mail]>]

The attack here is that an attacker might duplicate a legitimate packet and
send that packet from an invalid address such that it arrives before the real
copy.  That causes the recipient to think that there was a connection
migration.  They will attempt to validate that address and this will fail.  The
connection is then closed.

The fix is to cause a migration back to the original, legitimate address.  For
this to work, you need two things:

1. when a migration happens, abandon any validation on the old address on the
   expectation that it will fail

2. when a migration happens, make sure that you try to trigger packets from the
   old address first

For the second point, I decided to mandate address validation, rather than an
ordinary PING.  The reason being that you have to retransmit the packet on that
path and I doubt that implementations will want to have two sets of special
machinery for transmiting - and retransmitting - frames on a specific path.
Maybe this is too much of a constraint on implementations, so I'd like to hear
from people about whether they would prefer a more generic requirement (send
any packet that demands acknowledgment would work, it doesn't even have to be
the same packet every time, though the usual situation will be that the packet
will be lost, so you probably don't want to send anything important).
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/746

-- Commit Summary --

  * Avoid attack on address validation during connection migration

-- File Changes --

    M draft-ietf-quic-transport.md (47)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/746.patch
https://github.com/quicwg/base-drafts/pull/746.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/746