quic: flip preferred address policy default to 'ignore'

jasnell · aduh95 · commit 75a4176b320f · 2026-05-27T11:35:47.000+02:00
Signed-off-by: James M Snell <jasnell@gmail.com> Assisted-by: Opencode:Opus 4.6 PR-URL: #63483 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
diff --git a/doc/api/quic.md b/doc/api/quic.md
@@ -2776,9 +2776,15 @@ added: v23.8.0
 -->
 
 * Type: {string} One of `'use'`, `'ignore'`, or `'default'`.
+* **Default:** `'ignore'`
 
 When the remote peer advertises a preferred address, this option specifies whether
-to use it or ignore it.
+to use it or ignore it. The default is `'ignore'` because honoring a server's
+preferred address causes the client to migrate its connection to a different IP
+address, which can be exploited for data exfiltration attacks that are
+indistinguishable from legitimate QUIC connection migration at the network level.
+Set to `'use'` only when connecting to trusted servers that require preferred
+address migration.
 
 #### `sessionOptions.qlog`
 
diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
@@ -4919,7 +4919,7 @@ function processSessionOptions(options, config = kEmptyObject) {
     reuseEndpoint = true,
     version,
     minVersion,
-    preferredAddressPolicy = 'default',
+    preferredAddressPolicy = 'ignore',
     transportParams = kEmptyObject,
     qlog = false,
     sessionTicket,
diff --git a/src/quic/preferredaddress.cc b/src/quic/preferredaddress.cc
@@ -140,7 +140,7 @@ void PreferredAddress::Initialize(Environment* env, Local<Object> target) {
   static constexpr auto PREFERRED_ADDRESS_IGNORE =
       static_cast<uint8_t>(Policy::IGNORE_PREFERRED);
   static constexpr auto DEFAULT_PREFERRED_ADDRESS_POLICY =
-      static_cast<uint8_t>(Policy::USE_PREFERRED);
+      static_cast<uint8_t>(Policy::IGNORE_PREFERRED);
 
   NODE_DEFINE_CONSTANT(target, PREFERRED_ADDRESS_IGNORE);
   NODE_DEFINE_CONSTANT(target, PREFERRED_ADDRESS_USE);
diff --git a/test/parallel/test-quic-callback-error-onpathvalidation.mjs b/test/parallel/test-quic-callback-error-onpathvalidation.mjs
@@ -36,6 +36,7 @@ const serverEndpoint = await listen(mustCall(async (serverSession) => {
 
 const clientSession = await connect(serverEndpoint.address, {
   reuseEndpoint: false,
+  preferredAddressPolicy: 'use',
   onpathvalidation() {
     throw testError;
   },
diff --git a/test/parallel/test-quic-diagnostics-channel-path.mjs b/test/parallel/test-quic-diagnostics-channel-path.mjs
@@ -47,6 +47,7 @@ const serverEndpoint = await listen(mustCall(async (serverSession) => {
 
 const clientSession = await connect(serverEndpoint.address, {
   reuseEndpoint: false,
+  preferredAddressPolicy: 'use',
   // The onpathvalidation must be set for the JS handler to fire,
   // which in turn publishes to the diagnostics channel.
   onpathvalidation: mustCall(),
diff --git a/test/parallel/test-quic-session-preferred-address-ipv6.mjs b/test/parallel/test-quic-session-preferred-address-ipv6.mjs
@@ -81,6 +81,7 @@ console.log(serverEndpoint.address);
 const clientSession = await connect(serverEndpoint.address, {
   // We don't want this endpoint to reuse either of the two listening endpoints.
   reuseEndpoint: false,
+  preferredAddressPolicy: 'use',
   transportParams: { maxDatagramFrameSize: 1200 },
   ondatagramstatus: mustCall((id, status) => {
     if (++statusCount >= 4) allStatusDone.resolve();
diff --git a/test/parallel/test-quic-session-preferred-address.mjs b/test/parallel/test-quic-session-preferred-address.mjs
@@ -65,6 +65,7 @@ const serverEndpoint = await listen(handleSession, {
 const clientSession = await connect(serverEndpoint.address, {
   // We don't want this endpoint to reuse either of the two listening endpoints.
   reuseEndpoint: false,
+  preferredAddressPolicy: 'use',
   transportParams: { maxDatagramFrameSize: 1200 },
   ondatagramstatus: mustCall((id, status) => {
     if (++statusCount >= 4) allStatusDone.resolve();
