Re: [quicwg/base-drafts] Be more conservative about migration? (#2143)

[Martin Thomson <[e-mail]>]

Proposal from Tokyo:

Endpoints MUST validate new paths before using them.  In reaction to a migration they MUST continue using the old path until they receive new non-probing packets on the new path AND validation of that path is complete.  

Research question: Allow an exception in the case that the rebinding appears to be a NAT rebinding.  Heuristics are necessary here: e.g., a port-only change after a period of inactivity.  If we adopt the strict requirement, but learn that we get a lot of hitches from apparent migration, then we can find a way to relax the requirement.  If we allow this exception, then we have to address the problem of what to do when there are multiple such changes in a short period.  ==> Open this as an issue to track the research question.

Otherwise, eliminate the distinction between IP and port changes and just say "address change".

Stricter rules would close off the ability for an attacker to force a connection into a non-functioning state, even if that state is temporary.  The cost is that migration can result in a delay of a round trip or more.

(We might also want to know more about the severity of the attack.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2143#issuecomment-458815073