Comment by ButlerianJihad
4 hours ago
MPTCP is a protocol extension that requires cooperation by both peers and all middleboxes. So, if there is a Layer 7 firewall, or DPI/SPI, or TLS termination on the path, and it's not inclined to preserve the MPTCP options, then MPTCP will be disabled.
Firewalls do not operate at layer 7 nor do TLS termination.
What you’re thinking of is load balancers. Most of them will do TLS termination. But there’s also plenty of load balancing solutions out there that will forward the raw TCP traffic (AWS NLB, DNS based solutions, and so forth).
But it’s also worth noting that this vulnerability doesn’t explicitly need MPTCP. Just the POC exploit uses that.
fnord
Wait. So; just because you've studied with someone makes your opinion correct? Damn. I wish I would have known that long ago! In both my education tracts of medicine and CS, I've studied with some pretty great minds and I could have been passing off my opinion as fact for decades now.
I wish I would have received that memo. </sarcasm>
A request from authority isn’t a counter argument. And it doesn’t mean your opinions about this attack were correct.
Congratulations on knowing what a bastion server is though. But that’s extremely common knowledge and doesn’t prove your point either.
Perhaps you can share how a layer 7 inspection tool might mitigate a layer 4 attack an actual networking terms?