[quicwg/base-drafts] Connection migration failure mode (#1278)

[Martin Thomson <[e-mail]>]

>From @ekr,

> To add to my previous comment about attacks, in cases where one side has totally migrated (i.e., only one path is valid), then an attacker can also mess things up pretty severely by just spoofing a response to a PATH_CHALLENGE. I.e.,
>
> 1. I am receiving packets from A
> 2. A migrates and so sends me a packet from A'
> 3. I send a PATH_CHALLENGE to A'
> 4. If the attacker forwards the next packet from A' (likely a PATH_RESPONSE) but rewrites the source address to B, then I will consider the validation failed.

What is especially pernicious here is that the migration might not be voluntary, and so there is no option to repair the condition.  Multiple challenges make this harder to effect the attack, but that's all.  Currently the draft seems to imply that a single PATH_RESPONSE like this is enough to cause the path to be marked as invalid, see #1277.

We could decide that this is akin to messing with a handshake and decide to limit our reaction to this to documentating it.  But we could also try to make the process more robust, with the caution that pulling on this thread potentially leads to a reiteration of RFC 5245.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1278