Subject: [quicwg/base-drafts] ICMP DOS (#2063)

From: MikkelFJ <[email-masked]>
Date: Wed, 28 Nov 2018 03:23:30 -0800

I read through the recent PR #2036 which cleans up the packet size discussion. The text does touch upon ICMP denial of service attacks but I'm afraid the protection is too fragile because it is required that transmission stops on a path where PMTU is suspected to have been decreased. It is not explicitly stated (as far as I can tell) that ICMP packet too big is used for this decision, but it is used in PMTU discovery.

There is no major problem with attacks on discovery, but if ICMP can later close a connection, that is a big problem.

There is protection against off path attackers, but it is easy for a man on the side attack to generate ICMP messages that would pass validation. This only requires one compromised machine on a LAN.

This issue also relates to the ongoing discussion on protection against the initial handshake by man on the side stopping handshake by generating invalid early handshake packets, only here it can happen long after the connection is established.

A possible mitigation could be that a path should not be dropped based in ICMP messages alone but only after one or two new new PMTU probes.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2063

---

From: MikkelFJ <[email-masked]>
Date: Wed, 28 Nov 2018 13:00:41 -0800

A possible resolution is to never allow ICMP to reduce a path below 1200 bytes or so, corresponding to the handshake discovery. Dropping a path should then solely be based on a) having a better path to switch to, or b) that packets loss rate is getting too high for the application to tolerate.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2063#issuecomment-442602796

---

From: Martin Thomson <[email-masked]>
Date: Wed, 28 Nov 2018 19:01:13 -0800

Not allowing ICMP to reduce the PMTU below 1280 was always the intent.  I can't see that anywhere, so we should add it.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2063#issuecomment-442688797

---

From: Martin Thomson <[email-masked]>
Date: Thu, 29 Nov 2018 14:48:33 -0800

Closed #2063 via #2069.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2063#event-1996615603