[quicwg/base-drafts] Stateless Reset processing must be path-bound (#1264)

[Mike Bishop <[e-mail]>]

#1259 might introduce a new potential vulnerability while closing a different one.  SR tokens are single-use -- once they're disclosed to the network, the CID is burned because now anyone on-path has the token.  But that's generally okay, because the connection will be closing anyway.

Now consider:
- Client has connection to server using CID1 on Path A
- Client probes server using CID2 on Path B
- Probe is misdirected (different server endpoint), which generates and responds with a Stateless Reset for CID2, leaking the SR token
- Attacker guesses that CID1 on Path A might be the same connection as CID2 on Path B and injects a Stateless Reset on Path B with the same token

Depending how the client processes this, the connection might be terminated by the attacker.  If the client checks the SR token against the set of CIDs which have been associated with this connection, it will find it and close this connection.  To guard against this, an implementation needs to use a CID on only one path and consider only stateless reset tokens for CIDs which have been used on the path where the SR was received within a reasonably recent time period.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1264