I am aware that IP spoofing can be used to carry out SYN flooding attacks, and impersonating servers.
However, I have not been able to find detailed step-by-step attack scenarios: where the attacker (let’s assume is on-path between the client and the server) spoofs the client IP address and attempts a TLS connection with the server. Will the attacker succeed in creating this TLS session, fully impersonating the client? How would the attacker do so, when all response packets will be routed to the client?
Additionally, if the server only accepts connections from that client IP, would this attack still be possible?
Let’s also assume TLS mutual authentication is not used.