{"action":"created","issue":{"url":"https://api.github.com/repos/quicwg/base-drafts/issues/2143","repository_url":"https://api.github.com/repos/quicwg/base-drafts","labels_url":"https://api.github.com/repos/quicwg/base-drafts/issues/2143/labels{/name}","comments_url":"https://api.github.com/repos/quicwg/base-drafts/issues/2143/comments","events_url":"https://api.github.com/repos/quicwg/base-drafts/issues/2143/events","html_url":"https://github.com/quicwg/base-drafts/issues/2143","id":390683625,"node_id":"MDU6SXNzdWUzOTA2ODM2MjU=","number":2143,"title":"Be more conservative about migration?","user":{"login":"ekr","id":1111457,"node_id":"MDQ6VXNlcjExMTE0NTc=","avatar_url":"https://avatars0.githubusercontent.com/u/1111457?v=4","gravatar_id":"","url":"https://api.github.com/users/ekr","html_url":"https://github.com/ekr","followers_url":"https://api.github.com/users/ekr/followers","following_url":"https://api.github.com/users/ekr/following{/other_user}","gists_url":"https://api.github.com/users/ekr/gists{/gist_id}","starred_url":"https://api.github.com/users/ekr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekr/subscriptions","organizations_url":"https://api.github.com/users/ekr/orgs","repos_url":"https://api.github.com/users/ekr/repos","events_url":"https://api.github.com/users/ekr/events{/privacy}","received_events_url":"https://api.github.com/users/ekr/received_events","type":"User","site_admin":false},"labels":[{"id":481871399,"node_id":"MDU6TGFiZWw0ODE4NzEzOTk=","url":"https://api.github.com/repos/quicwg/base-drafts/labels/-transport","name":"-transport","color":"fbca04","default":false},{"id":481871361,"node_id":"MDU6TGFiZWw0ODE4NzEzNjE=","url":"https://api.github.com/repos/quicwg/base-drafts/labels/design","name":"design","color":"1d76db","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-12-13T13:40:59Z","updated_at":"2018-12-13T23:35:54Z","closed_at":null,"author_association":"COLLABORATOR","body":"I've been reading through the migration mechanism and it seems to me\r\nthat assuming that a packet from a given IP address is evidence of\r\nmigration creates a pretty easy DoS attack from an on-path attacker.\r\nConsider the case where we have a quiescent connection between A and B\r\nand an on-path attacker and then B sends a packet to A.\r\n\r\nIn the diagram below, the notation [A:B]: Z -> means a packet with a\r\nsource addr of A, a dest addr of B, and a payload of Z\r\n\r\n```\r\nA                       Attacker (Z)                  B\r\n\r\n                                         <- [B:A]: Data\r\n                     <- [B:A]: Data\r\n[A:B]: ACK ->\r\n                        [Z:B]: ACK ->\r\n\r\n                                       X <- [B:Z]: Data\r\n                                       X <- [B:Z]: Probe\r\n```\r\n                                       \r\nAs long as A doesn't try to send a data packet, B will continue to\r\nthink that A is at Z for the duration of the validation timer\r\n(currently 3 RTO?) [0]. That's not the worst thing in the world, but\r\nit's a pretty good cost/benefit for an on-path attacker who only has\r\nto forge one packet; I'm not sure that that's a great design tradeoff\r\nfor a protocol where we're otherwise trying to stop on-path attacker\r\nfrom interfering with the connection after the handshake completes.\r\n\r\nThe reason this works is the receipt of a packet from addr X is a\r\ntrigger for abandoning the previous path and trying migration. Another\r\ntime this can happen is at the tail of a client transmission,\r\nthough that will presumably recover faster.\r\n\r\nAt a high level, it seems like there are two major types of\r\nmigration:\r\n\r\n1. Unknown migration (e.g., NAT re-binding)\r\n2. Known migration (e.g., transferring from WiFi to 3G)\r\n\r\nIn the latter case, we can have the client give notice that it's\r\nmigrating, even if it doesn't know it's visible IP address, and have\r\nthe server refuse to change peer addresses unless it sees that\r\nindication, so it's just the former case we have to deal with, and as\r\nabove. The present design does that but at the cost of creating the\r\nsituation above.\r\n\r\nI wonder if we should be more conservative about initiating migration.\r\nI don't have a fully worked out proposal, but here are some ideas:\r\n\r\n- Send packets to both the original and new addresses during the\r\n  validation period.\r\n  \r\n- If you receive an apparent migration that looks like a rebinding\r\n  (e.g., same address, different port) within X seconds of a previous\r\n  packet, then probe first (or in parallel as above).\r\n\r\n- Have the client send some packet that indicates it thinks it's\r\n  migrating (this seems tricky to get right)\r\n\r\n\r\n[0] Note that if we were to allow migration on the client and the\r\nserver, even worse attacks are possible.\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/quicwg/base-drafts/issues/comments/447160355","html_url":"https://github.com/quicwg/base-drafts/issues/2143#issuecomment-447160355","issue_url":"https://api.github.com/repos/quicwg/base-drafts/issues/2143","id":447160355,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NzE2MDM1NQ==","user":{"login":"ekr","id":1111457,"node_id":"MDQ6VXNlcjExMTE0NTc=","avatar_url":"https://avatars0.githubusercontent.com/u/1111457?v=4","gravatar_id":"","url":"https://api.github.com/users/ekr","html_url":"https://github.com/ekr","followers_url":"https://api.github.com/users/ekr/followers","following_url":"https://api.github.com/users/ekr/following{/other_user}","gists_url":"https://api.github.com/users/ekr/gists{/gist_id}","starred_url":"https://api.github.com/users/ekr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekr/subscriptions","organizations_url":"https://api.github.com/users/ekr/orgs","repos_url":"https://api.github.com/users/ekr/repos","events_url":"https://api.github.com/users/ekr/events{/privacy}","received_events_url":"https://api.github.com/users/ekr/received_events","type":"User","site_admin":false},"created_at":"2018-12-13T23:35:54Z","updated_at":"2018-12-13T23:35:54Z","author_association":"COLLABORATOR","body":"Why is it probing B->A?"}}
{"actor":{"display_login":"ekr"}}