Subject: [multipathtcp] DoS attacks and MPTCP

From: Olivier Bonaventure <[email-masked]>
Date: Mon, 22 Nov 2010 22:21:18 +0100

Hello,

Denial of service issues are a concern for TCP. Most deployed stacks
rely on syn-cookies to allow a server to only create state upon
reception of the third segment of the three-way handshake. This proves
that the host that sent the SYN received the SYN+ACK segment and that
the SYN segment was not spoofed.

Due to these syncookies, the current mptcp handshake has been adapted as
follows :

              Host A                                     Host B
     ------------------------                   ------------------------
     Address A1    Address A2                   Address B1    Address B2
     ----------    ----------                   ----------    ----------
         |             |                            |             |
         |         SYN + MP_CAPABLE(Key-A)          |             |
         |----------------------------------------->|             |
         |<-----------------------------------------|             |
         |       SYN/ACK + MP_CAPABLE(Key-B)        |             |
         |             |                            |             |
         |      ACK + MP_CAPABLE(Key-A, Key-B)      |             |
         |----------------------------------------->|             |

The initiator retranmits the keys in the ACK segment to allow the
responder to create its state only upon reception of the ACK segment.

For the initial subflow, I think that it is important to protect the
server from denial of service attacks.

For the subflows, I'd like to sense the opinion of the working group on
whether there is a risk of denial of service attack to be considered :

 - for the initial subflow
 - for the subsequent subflows (is the token placed in the SYN
sufficient to avoid DoS attacks by allowing host B to associate the SYN
to an existing MPTCP connection)

Thanks

Olivier

-- 
INL, ICTEAM, UCLouvain, Belgium, http://inl.info.ucl.ac.be

---

From: "McDonald, Andrew" <[email-masked]>
Date: Tue, 30 Nov 2010 15:35:43 +0000

>   - for the initial subflow

I think this is worth considering, in the general 'no worse than TCP' vein.

Ensuring compatibility with TCPCT may be sufficient.

> to an existing MPTCP connection)

I think the token we have now is sufficient here -  if the receiver 
doesn't have the matching state he can reject the connection immediately.

regards,

Andrew