Comment by Eueudhsbsj32
4 hours ago
But any sane configuration would have the MPTCP port blocked behind a firewall (unless you were intentionally using MPTCP).
4 hours ago
But any sane configuration would have the MPTCP port blocked behind a firewall (unless you were intentionally using MPTCP).
> MPTCP port blocked
MPTCP doesn’t use any specific ports. It’s an OSI layer higher than that. It’s part of the TCP protocol itself. So if your firewall routes TCP traffic of a specific port (eg HTTP) already then it’ll route MPTCP along with it too.
MPTCP is a protocol extension that requires cooperation by both peers and all middleboxes. So, if there is a Layer 7 firewall, or DPI/SPI, or TLS termination on the path, and it's not inclined to preserve the MPTCP options, then MPTCP will be disabled.
Firewalls do not operate at layer 7 nor do TLS termination.
What you’re thinking of is load balancers. Most of them will do TLS termination. But there’s also plenty of load balancing solutions out there that will forward the raw TCP traffic (AWS NLB, DNS based solutions, and so forth).
But it’s also worth noting that this vulnerability doesn’t explicitly need MPTCP. Just the POC exploit uses that.