Re: [quicwg/base-drafts] Connection migration failure mode (#1278)

[erickinnear <[e-mail]>]

One of the things that was really nice about uninitiated migration (such as NAT rebinding) generating PATH_CHALLENGE frames was that the endpoint has a potential indication that something like a rebinding may have occurred. 

I *think* that we allowed the endpoint to omit PATH_CHALLENGE when switching back to the "old" path for cases like these where a packet may have been raced or otherwise interfered with by an attacker, but perhaps we should always require it, which would cover this case as well. 

That still doesn't necessarily cover the case where an attacker can race both a path challenge and a path response, but at some point they're on path and forwarding your packets.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1278#issuecomment-436117121