HTTP/3 - IETF QUIC Vulnerabilities Proof of Concept

Authors: Hari Hara Sudhan, MTech CSE, IIT Gandhinagar

Sameer G. Kulkarni, Assistant Professor, IIT Gandhinagar

Dependencies

This project is build on top of the opensource aioquic project (https://github.com/aiortc/aioquic).

Virtual Machine

For the Denial of Service demonstration, a VM connected to NAT is required. For the experiment, VMWare Workstaion Player with NAT timeout set to 300 seconds was used.

aioquic Requirements

aioquic requires Python 3.8 or better, and the OpenSSL development headers.

Debian/Ubuntu run:

sudo apt install libssl-dev python3-dev

Windows

On Windows the easiest way to install OpenSSL is to use Chocolatey.

choco install openssl

You will need to set some environment variables to link against OpenSSL:

$Env:INCLUDE = "C:\Progra~1\OpenSSL\include"
$Env:LIB = "C:\Progra~1\OpenSSL\lib"

Install the QUIC Library as Python Package

pip install .

Denial Of Service

For the demonstation, the setup is a follows:

1. The Server will be in the host machine (Windows in my case).
2. The Client will be in a VMWare Ubuntu VM, connected to a NAT.
3. The Client script uses IP addresses 192.168.40.128 - 192.168.40.135. Configure the IP address using the steps below.

Details Required

1. IP Address of the host that connects to the internet.
2. IPv4 Address of VM connected to NAT.

Add Additional IP Addresses using

sudo ip addr add 192.168.40.130 dev ens33

Alternatively, you can modify the script (./add_ip.sh) in repo to add multiple ip addresses

sudo bash add_ip.sh

Server Start

Replace 10.7.55.152 with your host IP Address

python .\dos\dos_server.py -c tests/ssl_cert.pem -k tests/ssl_key.pem --port 8053 --host 10.7.55.152

Client Start

Replace 10.7.55.152 with your host IP Address

python ./dos/dos_client.py --port 8053 -v --host 10.7.55.152

Covert Channel

Server Start

Replace 172.25.128.1 with your host IP Address

python .\covert\covert_server.py -c tests/ssl_cert.pem -k tests/ssl_key.pem --port 8053 --host 172.25.128.1

Client Start

python ./covert/covert_client.py --port 8053 -v --host 172.25.128.1 --insecure