Re: [tsvwg] UDP source ports for HTTP/3 and QUIC

[Joseph Touch <[e-mail]>]

Hi, Mark,

> On Jul 24, 2021, at 7:29 PM, Mark Nottingham <[e-mail]> wrote:
> 
> 
> 
>> On 25 Jul 2021, at 3:58 am, Joseph Touch <[e-mail]> wrote:
>> 
>> Hi, David,
>> 
>>> On Jul 23, 2021, at 9:05 AM, Black, David <[e-mail]> wrote:
>>> 
>>>> This is the core Issue though. So we have a problem where people generate spoofed traffic.
>>>> 
>>>> And some patterns of that traffic can be identified by how they use source ports.
>>> 
>>> In the cases of interest for this discussion, the source ports are real not spoofed.
>> 
>> Correct me if I’m not tracking:
>> 
>> A- some people send spoofed packets as attacks
>> B- the packets have one thing in common - use of particular source ports
> 
> No, it's more like
> 
> A - some people identify services that allow reflection attacks (often, wit
> h a significant amplification factor)
> B - those services often use specific source ports

Your descriptions are consistent with mine; I’m OK with yours.

It’s the next two that are the issue...

> 
>> C- so others have started to filter based on those source ports
>> D- which means legitimate uses of those ports are now blocked.

>> ..
>> This is a common IETF fallacy:
>> 
>> A. Some people do X
>> B. There is a correlation between X and Y (not cause and effect)
>> C. Others interpret X as bad, leaping from correlation to cause and effect
>> D. We all have to deal with it (complexity)
>> 
>> We need to stop this at step C and declare THAT the problem.
> 
> That may be the problem from your perspective, but from the perspective of people operating services on the Internet, it definitely isn't. 

People care that their traffic is incorrectly being treated as an attack.

Sure, they’ll accept anything the can do to avoid the issue. However, that may not be good for the Internet as it evolves.

> And there is already a precedent of a sort for that view in BCP38:
> 
> """
>   Similar attacks have been attempted using UDP and ICMP flooding.
>   The former attack (UDP flooding) uses forged packets to try and
>   connect the chargen UDP service to the echo UDP service at another
>   site.  Systems administrators should NEVER allow UDP packets destined
>   for system diagnostic ports from outside of their administrativeer 
>   domain to reach their systems.
> """

Agreed; but “designed for” are destination, not source ports. Destination ports indicate both service and socket pair, but source ports are ONLY an indicator of demux. 

We have never registered source ports for a reason - they don’t indicate service. The current error of assuming other meaning to those ports (i.e., that 0 means an attack) is just as bad an idea.

Joe