[quicwg/base-drafts] Attacks Against Address Migration (#2582)

[martinduke <[e-mail]>]

There are a few DoS vectors in migration that aren't well addressed in the draft. @erickinnear will follow soon with a short PR to address this issue.

The current draft presents a specific case of a general attack. The generalized form of the attack is that the attacker observes both paths. He clones all packets from the client so that they appear to be from both addresses, and makes sure that all packets the server sends to each address both arrive at the client. He has the capability to out-race packets he observes.

The attacker might fabricate a NAT rebinding that didn't happen, or spoof the old address during a rebinding. 

With PATH_CHALLENGE going out on both paths, these duplicate packets create four outcomes depending on which packets arrive first: both paths appear to be valid, the right path only is valid, the wrong path only is valid, or neither path is valid. The current requirement that the source address of PATH_RESPONSE matches the destination of the PATH_CHALLENGE can cause validation of the correct path to fail.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2582