Subject: [quicwg/base-drafts] Spoofed connection migration as a DoS vector (#2342)

From: Igor Lubashev <[email-masked]>
Date: Thu, 17 Jan 2019 09:41:32 -0800

Section 9 "Connection Migration" has this text:

> An endpoint which has sent this [disable_migration] transport parameter, but detects that a peer has nonetheless migrated to a different network MAY treat this as a connection error of type INVALID_MIGRATION.

How can an endpoint distinguish "a peer has nonetheless migrated to a different network" vs "an off-path attacker has resent/raced a packet from a different IP"?  An insidious attacker can actually own the new IP and proxy packets with PATH_CHALLENGE and resend packets with PATH_CHALLENGE_RESPONSE from its IP.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2342

---

From: Martin Thomson <[email-masked]>
Date: Sun, 20 Jan 2019 20:56:19 -0800

Yeah, that seems like too simple a DoS.

It sort of highlights the need to implement much of the migration machinery if you consider the risk of NAT rebinding.  Unless you plan to only permit remote address changes based on a "same network" heuristic.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2342#issuecomment-455948414

---

From: Martin Thomson <[email-masked]>
Date: Tue, 29 Jan 2019 23:13:42 -0800

Tokyo conclusion: with our answer to #2143, the endpoint that disables migration will have to do the full migration machinery.  If it doesn't do that work, then the server needs to drop the packet (thereby ignoring it).

Note that it can't send a stateless reset here, because that would produce the attack in a different form - our existing text on defense against stateless reset oracles would prohibit that anyway.

We should perhaps rename the transport parameter to "disable_explicit_migration" or "disable_active_migration".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2342#issuecomment-458837019