Re: [quicwg/base-drafts] 5tuple routing (#3536)

[Kazuho Oku <[e-mail]>]

@kazuho commented on this pull request.



> +thus support changing client IP addresses without difficulty.
+
+If a server does not implement one of the solutions above, it SHOULD send the
+disable_active_migration transport parameter to inform the client that any
+address change is likely to terminate the connection, which can lead it to use
+strategies to avoid NAT rebinding or terminate connections when its IP address
+changes.
+
+Regardless of other mitigations, servers behind 5-tuple routing MUST do one of
+the following to avoid creating a Reset Oracle ({{reset-oracle}}):
+
+* not send Stateless Reset under any circumstances, or
+* use a different Stateless Reset Token key than other servers, or
+* encode the client IP address and port in the Stateless Reset token. If using
+the preferred_address transport parameter, the token must also encode the
+preferred address.

@martinduke Thank you for the changes. This is better.

I would not argue against having a list, however I am still uncomfortable of this being a exhaustive list (i.e. "MUST do one of ..).

To give an example that is missing, it is safe for all the servers to share the key, assuming that they encode the server ID (that would be unique to each server) to the Stateless Reset Token.

Just giving an example of some feasible design would be much better, though by doing so, this paragraph might become a repetition of {{reset-oracle}}.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#pullrequestreview-381699564