Subject: Re: [quicwg/base-drafts] Migration before handshake completed is very messy (#2309)

From: Christian Huitema <[email-masked]>
Date: Tue, 04 Jun 2019 22:48:08 -0700

Updated the text to reference the output of PR #2673 as agreed during the London interim.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2309#issuecomment-498947339

---

From: Martin Thomson <[email-masked]>
Date: Tue, 04 Jun 2019 23:02:24 -0700

@mnot, @larseggert, this one looks good to go.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2309#issuecomment-498950138

---

From: Lars Eggert <[email-masked]>
Date: Tue, 11 Jun 2019 01:29:01 -0700

Quick question: We're forbidding active migration during the handshake here, but what about a passive NAT rebinding that may happen? We obviously can't forbid that, so we must either handle it or have the connection die quickly?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2309#issuecomment-500741737

---

From: Martin Thomson <[email-masked]>
Date: Tue, 11 Jun 2019 02:48:35 -0700

That's an issue, but a different one.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2309#issuecomment-500770191

---

From: Christian Huitema <[email-masked]>
Date: Tue, 11 Jun 2019 07:28:21 -0700

What @martinthomson said. I would personally treat NAT rebinding during handshake as an error, on the assumption that it will be extremely rare and is caused by a broken NAT.

We generally assume that NAT keep a UDP mapping active for at least 30 seconds -- the BEHAVE recommendation was 2 minutes. Having a mapping change in fewer than 2 RTT means the NAT is broken.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2309#issuecomment-500866985

---

From: ianswett <[email-masked]>
Date: Tue, 11 Jun 2019 07:29:45 -0700

Closing the connection introduces yet another way an attacker can interrupt the handshake.  It may be the preferable option, but it's worth noting.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2309#issuecomment-500867630

---

From: Christian Huitema <[email-masked]>
Date: Tue, 11 Jun 2019 09:29:01 -0700

@ianswett You don't have to close the connection to protect against NAT rebinding. Ignoring packets from the wrong addresses during the handshake is simpler and more robust. The picoquic implementation does something like that: accept the content of the handshake packet (not initial) if it decrypts correctly, ignore any address change until the handshake is confirmed.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2309#issuecomment-500920176

---

From: ianswett <[email-masked]>
Date: Tue, 11 Jun 2019 09:42:19 -0700

Good point, that SGTM.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2309#issuecomment-500925851

---

From: Christian Huitema <[email-masked]>
Date: Sat, 22 Jun 2019 22:43:03 -0700

Waiting on PR #2370 to close this issue.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2309#issuecomment-504722191