FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

quic: flip preferred address policy default to 'ignore' · nodejs/node@3f0d737 · GitHub

/ node Public

Commit 3f0d737

Browse files
jasnell
authored and
aduh95
committed
quic: flip preferred address policy default to 'ignore'
Signed-off-by: James M Snell <jasnell@gmail.com> Assisted-by: Opencode:Opus 4.6 PR-URL: #63483 Backport-PR-URL: #64675 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
1 parent 97c8a96 commit 3f0d737

7 files changed

Lines changed: 13 additions & 3 deletions

‎doc/api/quic.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2758,9 +2758,15 @@ added: v23.8.0
27582758
-->
27592759

27602760
* Type: {string} One of `'use'`, `'ignore'`, or `'default'`.
2761+
* **Default:** `'ignore'`
27612762

27622763
When the remote peer advertises a preferred address, this option specifies whether
2763-
to use it or ignore it.
2764+
to use it or ignore it. The default is `'ignore'` because honoring a server's
2765+
preferred address causes the client to migrate its connection to a different IP
2766+
address, which can be exploited for data exfiltration attacks that are
2767+
indistinguishable from legitimate QUIC connection migration at the network level.
2768+
Set to `'use'` only when connecting to trusted servers that require preferred
2769+
address migration.
27642770

27652771
#### `sessionOptions.qlog`
27662772

‎lib/internal/quic/quic.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4919,7 +4919,7 @@ function processSessionOptions(options, config = kEmptyObject) {
49194919
reuseEndpoint = true,
49204920
version,
49214921
minVersion,
4922-
preferredAddressPolicy = 'default',
4922+
preferredAddressPolicy = 'ignore',
49234923
transportParams = kEmptyObject,
49244924
qlog = false,
49254925
sessionTicket,

‎src/quic/preferredaddress.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ void PreferredAddress::Initialize(Environment* env, Local<Object> target) {
140140
static constexpr auto PREFERRED_ADDRESS_IGNORE =
141141
static_cast<uint8_t>(Policy::IGNORE_PREFERRED);
142142
static constexpr auto DEFAULT_PREFERRED_ADDRESS_POLICY =
143-
static_cast<uint8_t>(Policy::USE_PREFERRED);
143+
static_cast<uint8_t>(Policy::IGNORE_PREFERRED);
144144

145145
NODE_DEFINE_CONSTANT(target, PREFERRED_ADDRESS_IGNORE);
146146
NODE_DEFINE_CONSTANT(target, PREFERRED_ADDRESS_USE);

‎test/parallel/test-quic-callback-error-onpathvalidation.mjs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ const serverEndpoint = await listen(mustCall(async (serverSession) => {
3636

3737
const clientSession = await connect(serverEndpoint.address, {
3838
reuseEndpoint: false,
39+
preferredAddressPolicy: 'use',
3940
onpathvalidation() {
4041
throw testError;
4142
},

‎test/parallel/test-quic-diagnostics-channel-path.mjs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ const serverEndpoint = await listen(mustCall(async (serverSession) => {
4747

4848
const clientSession = await connect(serverEndpoint.address, {
4949
reuseEndpoint: false,
50+
preferredAddressPolicy: 'use',
5051
// The onpathvalidation must be set for the JS handler to fire,
5152
// which in turn publishes to the diagnostics channel.
5253
onpathvalidation: mustCall(),

‎test/parallel/test-quic-session-preferred-address-ipv6.mjs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ console.log(serverEndpoint.address);
8181
const clientSession = await connect(serverEndpoint.address, {
8282
// We don't want this endpoint to reuse either of the two listening endpoints.
8383
reuseEndpoint: false,
84+
preferredAddressPolicy: 'use',
8485
transportParams: { maxDatagramFrameSize: 1200 },
8586
ondatagramstatus: mustCall((id, status) => {
8687
if (++statusCount >= 4) allStatusDone.resolve();

‎test/parallel/test-quic-session-preferred-address.mjs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ const serverEndpoint = await listen(handleSession, {
6565
const clientSession = await connect(serverEndpoint.address, {
6666
// We don't want this endpoint to reuse either of the two listening endpoints.
6767
reuseEndpoint: false,
68+
preferredAddressPolicy: 'use',
6869
transportParams: { maxDatagramFrameSize: 1200 },
6970
ondatagramstatus: mustCall((id, status) => {
7071
if (++statusCount >= 4) allStatusDone.resolve();

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL