Date: Mon, 01 Apr 2019 21:16:36 -0700
From: martinduke <notifications@github.com>
Reply-To: quicwg/base-drafts
 <reply+0166e4ab486f84d2d9ab6b102d75825566967fbdfa0fcb9e92cf0000000118baa42492a169ce19830385@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/2582@github.com>
Subject: [quicwg/base-drafts] Attacks Against Address Migration (#2582)
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--==_mimepart_5ca2e224241d4_330c3fcdde4d45b85852ed";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/kqGEy20qRXEVSuePEGDZyDKp6fY>


----==_mimepart_5ca2e224241d4_330c3fcdde4d45b85852ed
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

There are a few DoS vectors in migration that aren't well addressed in the draft. @erickinnear will follow soon with a short PR to address this issue.

The current draft presents a specific case of a general attack. The generalized form of the attack is that the attacker observes both paths. He clones all packets from the client so that they appear to be from both addresses, and makes sure that all packets the server sends to each address both arrive at the client. He has the capability to out-race packets he observes.

The attacker might fabricate a NAT rebinding that didn't happen, or spoof the old address during a rebinding. 

With PATH_CHALLENGE going out on both paths, these duplicate packets create four outcomes depending on which packets arrive first: both paths appear to be valid, the right path only is valid, the wrong path only is valid, or neither path is valid. The current requirement that the source address of PATH_RESPONSE matches the destination of the PATH_CHALLENGE can cause validation of the correct path to fail.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2582
----==_mimepart_5ca2e224241d4_330c3fcdde4d45b85852ed
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

<p>There are a few DoS vectors in migration that aren't well addressed in the draft. <a class="user-mention" data-hovercard-type="user" data-hovercard-url="/hovercards?user_id=32474881" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/erickinnear">@erickinnear</a> will follow soon with a short PR to address this issue.</p>
<p>The current draft presents a specific case of a general attack. The generalized form of the attack is that the attacker observes both paths. He clones all packets from the client so that they appear to be from both addresses, and makes sure that all packets the server sends to each address both arrive at the client. He has the capability to out-race packets he observes.</p>
<p>The attacker might fabricate a NAT rebinding that didn't happen, or spoof the old address during a rebinding.</p>
<p>With PATH_CHALLENGE going out on both paths, these duplicate packets create four outcomes depending on which packets arrive first: both paths appear to be valid, the right path only is valid, the wrong path only is valid, or neither path is valid. The current requirement that the source address of PATH_RESPONSE matches the destination of the PATH_CHALLENGE can cause validation of the correct path to fail.</p>

<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">&mdash;<br />You are receiving this because you are subscribed to this thread.<br />Reply to this email directly, <a href="https://github.com/quicwg/base-drafts/issues/2582">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/AWbkq7palGHWOgmtO1_IzlP3r9v0WNnLks5vctmkgaJpZM4cXG2i">mute the thread</a>.<img src="https://github.com/notifications/beacon/AWbkq3A4_VlSdCynh7j3122fFa1ca3URks5vctmkgaJpZM4cXG2i.gif" height="1" width="1" alt="" /></p>
<script type="application/json" data-scope="inboxmarkup">{"api_version":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name":"GitHub"},"entity":{"external_key":"github/quicwg/base-drafts","title":"quicwg/base-drafts","subtitle":"GitHub repository","main_image_url":"https://github.githubassets.com/images/email/message_cards/header.png","avatar_image_url":"https://github.githubassets.com/images/email/message_cards/avatar.png","action":{"name":"Open in GitHub","url":"https://github.com/quicwg/base-drafts"}},"updates":{"snippets":[{"icon":"DESCRIPTION","message":"Attacks Against Address Migration (#2582)"}],"action":{"name":"View Issue","url":"https://github.com/quicwg/base-drafts/issues/2582"}}}</script>
<script type="application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/quicwg/base-drafts/issues/2582",
"url": "https://github.com/quicwg/base-drafts/issues/2582",
"name": "View Issue"
},
"description": "View this Issue on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script>
----==_mimepart_5ca2e224241d4_330c3fcdde4d45b85852ed--