Subject: Re: [quicwg/base-drafts] Request Forgery Attacks through Version Negotiation (#4258)

From: Martin Thomson <[email-masked]>
Date: Thu, 05 Nov 2020 20:12:43 -0800

@marten-seemann, trying to move discussion here.

You suggest that in a p2p deployment, the ability to control deployment of "server" instances is limited.

My response is that *in general* you need some sort of signaling between peers to communicate addresses for p2p.  NAT traversal generally requires it, and - if nothing else - you usually need to ship IP addresses for peers around.  Given that, I think that it is reasonable to include - in that signaling - information about supported protocols such that you should never need to generate a QUIC Version Negotiation in that context.

Maybe you don't care for that, but I think that it is probably better than accepting the exposure.

If you have an idea for how we might avoid this particular sort of request forgery without that, then I'm open to suggestions.  Right now, the proposal is that servers accept the risk and manage it.  But if there is a protocol change that would improve the situation, that might be better.  Assuming that it is minimally disruptive, of course.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4258#issuecomment-722802177

---

From: Marten Seemann <[email-masked]>
Date: Thu, 05 Nov 2020 20:51:40 -0800

> My response is that in general you need some sort of signaling between peers to communicate addresses for p2p. NAT traversal generally requires it, and - if nothing else - you usually need to ship IP addresses for peers around.

This independent of NAT traversal then. You'd also need to advertise addresses in a world where NATs wouldn't exist, and you could include QUIC version information in those address advertisements.

This still leaves the Bootstrap nodes susceptible to this attack (assuming you only hard-code a list of IP:ports without QUIC version information), but maybe that's ok, since you typically control those nodes yourself, or at least you can ask people running those nodes to take precautionary steps.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4258#issuecomment-722814278