randombit/botan

Stateless DTLS cookie verification

Open

#2,318 opened on Apr 3, 2020

View on GitHub
 (1 comment) (0 reactions) (0 assignees)C++ (654 forks)auto 404
enhancementhelp wanted

Repository metrics

Stars
 (3,283 stars)
PR merge metrics
 (PR metrics pending)

Description

It seems like that Botan requires every new DTLS client hello be handled in a new TLS_Server. Therefore, DTLS session cookies only provide protection against amplification, but not against resource exhaustion attacks. An attacker can easily consume a few hundred megabytes of memory by creating many TLS servers, without actually responding to hello verify requests.

Finding no clue in the documentation, I end up writing a very ugly solution like this:

std::vector<uint8_t> msg_contents(record_buf.begin() + 12, record_buf.begin() + length + 8);
Client_Hello client_hello(msg_contents);
Hello_Verify_Request verify(client_hello.cookie_input_data(), client_identity, cookie_secret);

if (client_hello.cookie() == verify.cookie())
{
	std::unique_ptr<Server> server(new Server(/* blablabla */));
	// monkey-patch the sequence numbers in Handshake_IO here
}
else
{
	std::unique_ptr<Datagram_Handshake_IO>
		handshake_io(new Datagram_Handshake_IO(/* blablabla */));
	handshake_io->send(verify);
}

Is there any facility in Botan to verify a DTLS cookie statelessly, like GnuTLS's gnutls_dtls_cookie_verify? If not, will there be any plan to add such an interface?

Contributor guide