Subject: [quicwg/base-drafts] Path validation should be done even for what looks like NAT rebinding (#2579)

From: Igor Lubashev <[email-masked]>
Date: Mon, 01 Apr 2019 04:56:47 -0700

Section 9 (Connection migration) says:

> NAT rebinding is not connection migration as defined in this section, though an endpoint SHOULD perform path validation (Section 8.2) if it detects a change in the IP address of its peer.

If the server does not perform path validation upon a port change and no ip address change, this becomes a possible DoS vector for an attacker behind the same NAT as the client.  The attacker must just capture and replay the packet from its own address, securing a new outgoing port on the NAT.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2579

---

From: Tatsuhiro Tsujikawa <[email-masked]>
Date: Mon, 01 Apr 2019 18:12:28 -0700

In my opinion, NAT rebinding should be treated like connection migration.  I don't see why we have to treat it differently.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2579#issuecomment-478804418

---

From: David Schinazi <[email-masked]>
Date: Mon, 01 Apr 2019 18:16:30 -0700

The difference is that when performing connection migration, the client MUST change connection ID. On the other hand, when the NAT rebinds, the client is not immediately aware of it and there will be packets with the old connection ID coming from the new NAT binding.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2579#issuecomment-478805472

---

From: Igor Lubashev <[email-masked]>
Date: Mon, 01 Apr 2019 18:30:07 -0700

@DavidSchinazi, the question is whether there is a difference from the server's pov. I am saying that server's response to any change in client source addresses/port SHOULD/MUST be path validation.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2579#issuecomment-478808096

---

From: erickinnear <[email-masked]>
Date: Mon, 01 Apr 2019 18:36:31 -0700

I have a branch out (PR coming soon) that removes this -- this part of the attack is something I think @martinduke was looking at a bit. 

To @DavidSchinazi's point, the change of CID is a really strong signal that the client intends to migrate, but we may want to move that into a note along with the section we have for "server should use heuristics/be smart about what to choose", since the definition in the text above doesn't really change the requirements on the server's behavior and that may confuse people. 

Whether or not we define it as migration really doesn't change a whole lot, since we say (or should say) that the server has to validate the new path anyways. In other words, always validate everything, unless it's something that's previously passed path validation and not the one you're migrating away from. 

@igorlord, note that the attack also relies on the attacker being able to race and beat the original client's packet to the server, but there's a whole section for that sort of attack (although I think we need to add to it a bit, or make a variant for the attacker overloading the NAT).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2579#issuecomment-478809319

---

From: David Schinazi <[email-masked]>
Date: Mon, 01 Apr 2019 18:51:57 -0700

I agree with @igorlord's and @erickinnear's points

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2579#issuecomment-478812198