randombit/botan

Stateless DTLS cookie verification

Open

#2318 aperta il 3 apr 2020

Vedi su GitHub
 (1 commento) (0 reazioni) (0 assegnatari)C++ (654 fork)auto 404
enhancementhelp wanted

Metriche repository

Star
 (3283 star)
Metriche merge PR
 (Metriche PR in attesa)

Descrizione

It seems like that Botan requires every new DTLS client hello be handled in a new TLS_Server. Therefore, DTLS session cookies only provide protection against amplification, but not against resource exhaustion attacks. An attacker can easily consume a few hundred megabytes of memory by creating many TLS servers, without actually responding to hello verify requests.

Finding no clue in the documentation, I end up writing a very ugly solution like this:

std::vector<uint8_t> msg_contents(record_buf.begin() + 12, record_buf.begin() + length + 8);
Client_Hello client_hello(msg_contents);
Hello_Verify_Request verify(client_hello.cookie_input_data(), client_identity, cookie_secret);

if (client_hello.cookie() == verify.cookie())
{
	std::unique_ptr<Server> server(new Server(/* blablabla */));
	// monkey-patch the sequence numbers in Handshake_IO here
}
else
{
	std::unique_ptr<Datagram_Handshake_IO>
		handshake_io(new Datagram_Handshake_IO(/* blablabla */));
	handshake_io->send(verify);
}

Is there any facility in Botan to verify a DTLS cookie statelessly, like GnuTLS's gnutls_dtls_cookie_verify? If not, will there be any plan to add such an interface?

Guida contributor