[quicwg/base-drafts] 481a7b: Avoid attack on address validation during connecti...

[Martin Thomson <[e-mail]>]

  Branch: refs/heads/mots-migration
  Home:   https://github.com/quicwg/base-drafts
  Commit: 481a7b5bfc24e9b11ea9dc1cbee1ad96975c10d4
      https://github.com/quicwg/base-drafts/commit/481a7b5bfc24e9b11ea9dc1cbee1ad96975c10d4
  Author: Martin Thomson <[e-mail]>
  Date:   2017-08-23 (Wed, 23 Aug 2017)

  Changed paths:
    M draft-ietf-quic-transport.md

  Log Message:
  -----------
  Avoid attack on address validation during connection migration

The attack here is that an attacker might duplicate a legitimate packet and
send that packet from an invalid address such that it arrives before the real
copy.  That causes the recipient to think that there was a connection
migration.  They will attempt to validate that address and this will fail.  The
connection is then closed.

The fix is to cause a migration back to the original, legitimate address.  For
this to work, you need two things:

1. when a migration happens, abandon any validation on the old address on the
   expectation that it will fail

2. when a migration happens, make sure that you try to trigger packets from the
   old address first

For the second point, I decided to mandate address validation, rather than an
ordinary PING.  The reason being that you have to retransmit the packet on that
path and I doubt that implementations will want to have two sets of special
machinery for transmiting - and retransmitting - frames on a specific path.
Maybe this is too much of a constraint on implementations, so I'd like to hear
from people about whether they would prefer a more generic requirement (send
any packet that demands acknowledgment would work, it doesn't even have to be
the same packet every time, though the usual situation will be that the packet
will be lost, so you probably don't want to send anything important).