Re: [quicwg/base-drafts] Document request forgery (#3996)

Igor Lubashev <> Fri, 14 August 2020 22:32 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id C66113A040F for <>; Fri, 14 Aug 2020 15:32:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.1
X-Spam-Status: No, score=-3.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 9kkfMMhgkGI3 for <>; Fri, 14 Aug 2020 15:32:10 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 5038D3A0407 for <>; Fri, 14 Aug 2020 15:32:10 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 4360784008E for <>; Fri, 14 Aug 2020 15:32:09 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=pf2014; t=1597444329; bh=M6bQ6KDoo8t/2cEt4c/N1fGjkVADt368bDaf14SZjdM=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=WFrRM1XFyreXlE9nbxeV4xFShcgY3/cFyS8CwKg8B/RPGw+FS7PQ9wNHOKT+14g6p RkzJeYBaUEqO+ww7JHnG8vexHOK5vbmF1a1IE1vbzvxv0Hhw6ZmZUdiAX8N8tut5h5 UFJ9zzdCiqXwDNX1OopBHVnNNw0vkGTB3dbfz7MI=
Date: Fri, 14 Aug 2020 15:32:09 -0700
From: Igor Lubashev <>
Reply-To: quicwg/base-drafts <>
To: quicwg/base-drafts <>
Cc: Subscribed <>
Message-ID: <quicwg/base-drafts/pull/3996/review/>
In-Reply-To: <quicwg/base-drafts/pull/>
References: <quicwg/base-drafts/pull/>
Subject: Re: [quicwg/base-drafts] Document request forgery (#3996)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5f3710e933cb1_684119641364b"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: igorlord
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
Archived-At: <>
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 14 Aug 2020 22:32:12 -0000

@igorlord commented on this pull request.

> +
+The most effective defense against request forgery attacks is to modify
+vulnerable services to use strong authentication. However, this is not always
+possible when deploying QUIC. This section outlines some others steps that QUIC
+endpoints could take. These additional steps are all discretionary as,
+depending on circumstances, they could interfere with or prevent legitimate
+Services offered over loopback interfaces (that is, ::1 or often
+lack proper authentication. Endpoints MAY prevent connection attempts or
+migration to a loopback address. Endpoints SHOULD NOT allow connections or
+migration to a non-loopback address if the same service was previously
+available over a different interface or the address was provided by a service
+at a non-loopback address. Endpoints that depend on these capabilities could
+offer an option to disable these protections.

@huitema This is certainly a way to mount an attack on services that assume that they are serving friendly clients and the network perimeter is secure.  It happens, especially when services listen only on RFC1918/unique-local or link-local IPs.  It happens even more often with services only listen to loopback and, therefore, think they are immune to any threats coming from outside of the host.

That's why I'd generalize this from "non-loopback -> loopback" to “globally routable IP space” -> “RFC1918/unique-local IP space” -> “link-local” -> “loopback”.

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub: