Re: [quicwg/base-drafts] Migration in Security Considerations (#2427)

[Martin Thomson <[e-mail]>]

martinthomson commented on this pull request.

Seems mostly right.  Though I would prefer something that simply highlighted the fact that a remote address is not expected to be stable over the lifetime of a connection.  Therefore, decisions that use an address as input need to either keep up to date, or accept the consequences of not doing so.

I would also point out that this is true even if migration is disabled.

> @@ -1463,6 +1463,13 @@ could pose a security risk to an incautious implementer.  An implementation MUST
 ensure that the length of a frame exactly matches the length of the fields it
 contains.
 
+Certain HTTP implementations use the client address for logging or
+access-control purposes.  Since QUIC supports path migration (and future
+versions might support simultaneous use of multiple paths), such implementations
+will need to actively retrieve the client's current address or addresses when

... will need to either actively retrieve the current address, or explicitly accept that the original address might change.

I don't think that they have to do either as long as the original requirement is recognized.  Of course, I would prefer to say that address-based access control is silly, but it is unfortunately still widely used, and not just for DoS mitigation.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2427#pullrequestreview-200376535