Date: Thu, 17 Jan 2019 09:41:32 -0800
From: Igor Lubashev <notifications@github.com>
Reply-To: quicwg/base-drafts
 <reply+0166e4abdb756c794a6236a3dfa2ea36b280a8d7df697fad92cf000000011858804c92a169ce17dd73ed@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/2342@github.com>
Subject: [quicwg/base-drafts] Spoofed connection migration as a DoS vector
 (#2342)
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--==_mimepart_5c40be4c5ddee_525f3fe9664d45c488869";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/aelR9immRzWzNhn-RDsMDC_O2RI>


----==_mimepart_5c40be4c5ddee_525f3fe9664d45c488869
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

Section 9 "Connection Migration" has this text:

> An endpoint which has sent this [disable_migration] transport parameter, but detects that a peer has nonetheless migrated to a different network MAY treat this as a connection error of type INVALID_MIGRATION.

How can an endpoint distinguish "a peer has nonetheless migrated to a different network" vs "an off-path attacker has resent/raced a packet from a different IP"?  An insidious attacker can actually own the new IP and proxy packets with PATH_CHALLENGE and resend packets with PATH_CHALLENGE_RESPONSE from its IP.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2342
----==_mimepart_5c40be4c5ddee_525f3fe9664d45c488869
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

<p>Section 9 "Connection Migration" has this text:</p>
<blockquote>
<p>An endpoint which has sent this [disable_migration] transport parameter, but detects that a peer has nonetheless migrated to a different network MAY treat this as a connection error of type INVALID_MIGRATION.</p>
</blockquote>
<p>How can an endpoint distinguish "a peer has nonetheless migrated to a different network" vs "an off-path attacker has resent/raced a packet from a different IP"?  An insidious attacker can actually own the new IP and proxy packets with PATH_CHALLENGE and resend packets with PATH_CHALLENGE_RESPONSE from its IP.</p>

<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">&mdash;<br />You are receiving this because you are subscribed to this thread.<br />Reply to this email directly, <a href="https://github.com/quicwg/base-drafts/issues/2342">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/AWbkq6h3ReVwHckJmsyVByg1qeYsS4tHks5vELXMgaJpZM4aGZ__">mute the thread</a>.<img src="https://github.com/notifications/beacon/AWbkq565vCc9eLB85xnDQuJKRTg3ZJf1ks5vELXMgaJpZM4aGZ__.gif" height="1" width="1" alt="" /></p>
<script type="application/json" data-scope="inboxmarkup">{"api_version":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name":"GitHub"},"entity":{"external_key":"github/quicwg/base-drafts","title":"quicwg/base-drafts","subtitle":"GitHub repository","main_image_url":"https://github.githubassets.com/images/email/message_cards/header.png","avatar_image_url":"https://github.githubassets.com/images/email/message_cards/avatar.png","action":{"name":"Open in GitHub","url":"https://github.com/quicwg/base-drafts"}},"updates":{"snippets":[{"icon":"DESCRIPTION","message":"Spoofed connection migration as a DoS vector (#2342)"}],"action":{"name":"View Issue","url":"https://github.com/quicwg/base-drafts/issues/2342"}}}</script>
<script type="application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/quicwg/base-drafts/issues/2342",
"url": "https://github.com/quicwg/base-drafts/issues/2342",
"name": "View Issue"
},
"description": "View this Issue on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script>
----==_mimepart_5c40be4c5ddee_525f3fe9664d45c488869--