Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Move wasteful packet stuff to -transport #2896

Merged
merged 3 commits into from
Aug 8, 2019
Merged

Move wasteful packet stuff to -transport #2896

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5c25156
Move wasteful packet stuff to -transport
martinthomson Jul 14, 2019
f299280
Tweak language more
martinthomson Jul 14, 2019
5078fc0
Reaction to attack
martinthomson Jul 17, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 0 additions & 14 deletions draft-ietf-quic-tls.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1388,20 +1388,6 @@ attacker cannot forge them. Put together, these defenses limit the level of
amplification.


## Peer Denial of Service {#useless}

QUIC, TLS, and HTTP/2 all contain messages that have legitimate uses in some
contexts, but that can be abused to cause a peer to expend processing resources
without having any observable impact on the state of the connection. If
processing is disproportionately large in comparison to the observable effects
on bandwidth or state, then this could allow a malicious peer to exhaust
processing capacity without consequence.

While there are legitimate uses for some redundant packets, implementations
SHOULD track redundant packets and treat excessive volumes of any non-productive
packets as indicative of an attack.


## Header Protection Analysis {#header-protect-analysis}

Header protection relies on the packet protection AEAD being a pseudorandom
Expand Down
26 changes: 26 additions & 0 deletions draft-ietf-quic-transport.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5442,6 +5442,7 @@ server to send an initial congestion window's worth of data towards the victim.
Servers SHOULD provide mitigations for this attack by limiting the usage and
lifetime of address validation tokens (see {{validate-future}}).


## Optimistic ACK Attack

An endpoint that acknowledges packets it has not received might cause a
Expand Down Expand Up @@ -5512,6 +5513,26 @@ effect of the stream commitment attack. However, setting the limit too low
could affect performance when applications expect to open large number of
streams.


## Peer Denial of Service {#useless}

QUIC and TLS both contain messages that have legitimate uses in some contexts,
but that can be abused to cause a peer to expend processing resources without
having any observable impact on the state of the connection.

Messages can also be used to change and revert state in small or inconsequential
ways, such as by sending small increments to flow control limits.

If processing costs are disproportionately large in comparison to bandwidth
consumption or effect on state, then this could allow a malicious peer to
exhaust processing capacity.

While there are legitimate uses for all messages, implementations SHOULD track
cost of processing relative to progress and treat excessive quantities of any
non-productive packets as indicative of an attack. Endpoints MAY respond to
this condition with a connection error, or by dropping packets.


## Explicit Congestion Notification Attacks {#security-ecn}

An on-path attacker could manipulate the value of ECN codepoints in the IP
Expand All @@ -5525,6 +5546,7 @@ the original to be successful in this attack. Therefore, QUIC endpoints ignore
the ECN codepoint field on an IP packet unless at least one QUIC packet in that
IP packet is successfully processed; see {{ecn}}.


## Stateless Reset Oracle {#reset-oracle}

Stateless resets create a possible denial of service attack analogous to a TCP
Expand All @@ -5549,6 +5571,7 @@ correct instance, it is better to send a stateless reset than wait for
connections to time out. However, this is acceptable only if the routing cannot
be influenced by an attacker.


## Version Downgrade {#version-downgrade}

This document defines QUIC Version Negotiation packets {{version-negotiation}},
Expand All @@ -5559,6 +5582,7 @@ Negotiation packets do not contain any mechanism to prevent version downgrade
attacks. Future versions of QUIC that use Version Negotiation packets MUST
define a mechanism that is robust against version downgrade attacks.


## Targeted Attacks by Routing

Deployments should limit the ability of an attacker to target a new connection
Expand All @@ -5568,6 +5592,7 @@ SHOULD NOT be used by themselves to make routing decisions. Ideally, routing
decisions are made independently of client-selected values; a Source Connection
ID can be selected to route later packets to the same server.


# IANA Considerations

## QUIC Transport Parameter Registry {#iana-transport-parameters}
Expand Down Expand Up @@ -5622,6 +5647,7 @@ The initial contents of this registry are shown in {{iana-tp-table}}.
| 0x000e | active_connection_id_limit | {{transport-parameter-definitions}} |
{: #iana-tp-table title="Initial QUIC Transport Parameters Entries"}


## QUIC Frame Type Registry {#iana-frames}

IANA \[SHALL add/has added] a registry for "QUIC Frame Types" under a
Expand Down