Implement QUIC server address validation
nhorman opened this issue · comments
Issue #302 depends on other issues, but contains no statement of work itself. Investigation is required to determine what, if any work is needed to complete that task.
This issue will potentially result in the creation of additional tracking isssues
Client address validation is covered by section 8. In a nutshell: to validate client IP address server must either:
- complete TLS handhake with client
- or ask client to present a validation token generated by server (this is covered by section 8)
whenever client sends its first UDP packet to server, the server may reply with 'RETRY' packet. The retry packet contains a validation token. Client is supposed to send token back to server as a reply to retry packet. This way can server verofu c;oemt's IP address before TLS handshake completes.
The branch here is a proof of concept which generates retry packet with token. The remaining piece to finish is to add implementation of ossl_quic_verify_retry_integrity_token() (if I remember correct). Then the whole piece needs to be debugged.
My complexity estimate to finish it is 8.
Outstanding task here is to to turn @Sashan poc branch into a pr, fininsh implementation of ossl_quic_verify_retry_integrity_token and get it reviewed and merged