Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add warning about request forgery and client-side migration. Fixes #4086 #4104

Merged
merged 3 commits into from Sep 22, 2020
Merged

Add warning about request forgery and client-side migration. Fixes #4086 #4104

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
647c68f
Add warning about request forgery and client-side migration. Fixes #4086
ekr Sep 16, 2020
e0bec93
Update draft-ietf-quic-transport.md
ekr Sep 17, 2020
b6bffb4
wrap
martinthomson Sep 17, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
26 changes: 13 additions & 13 deletions draft-ietf-quic-transport.md
View file
Open in desktop
Expand Up @@ -6440,21 +6440,21 @@ This section also describes limited countermeasures that can be implemented by
QUIC endpoints. These mitigations can be employed unilaterally by a QUIC
implementation or deployment, without potential targets for request forgery
attacks taking action. However these countermeasures could be insufficient if
UDP-based services do not properly authorize requests.
UDP-based services do not properly authorize requests.

Because the migration attack described in
{{request-forgery-with-spoofed-migration}} is quite powerful and does
not have adequate countermeasures, QUIC server implementations should
assume that attackers can cause them to generate arbitrary UDP
payloads to arbitrary destinations. QUIC servers SHOULD NOT be
deployed in networks that also have inadequately secured UDP
endpoints.

Although it is not generally possible to ensure that
clients are not co-located with vulnerable endpoints, this version of
QUIC does not allow servers to migrate, thus preventing spoofed
migration attacks on clients. Any future extension which allows
server migration MUST also define countermeasures for forgery attacks.
{{request-forgery-with-spoofed-migration}} is quite powerful and does not have
adequate countermeasures, QUIC server implementations should assume that
attackers can cause them to generate arbitrary UDP payloads to arbitrary
destinations. QUIC servers SHOULD NOT be deployed in networks that also have
inadequately secured UDP endpoints.

Although it is not generally possible to ensure that clients are not co-located
with vulnerable endpoints, this version of QUIC does not allow servers to
migrate, thus preventing spoofed migration attacks on clients. Any future
extension which allows server migration MUST also define countermeasures for
forgery attacks.


### Control Options for Endpoints

Expand Down