Subject: [Mobike] Issue 41: Mandate NAT prevention if not doing NAT-T?

From: <[email-masked]>
Date: Fri, 9 Sep 2005 13:02:29 +0300

(I've split this away from issue 40.)

The current version of the protocol draft does not require hosts 
that do not support NAT-T to use the "NAT prevention" feature.

Francis has suggested that this "middle ground" should be eliminated;
in other words, the initiator would always include either
NAT_DETECTION_*_IP (if it supports NAT-T) or NAT_PREVENTION (it it
doesn't) in all IKE_SA_INIT and UPDATE_SA_ADDRESSES messages.

Any comments about this?

My gut feeling is that we should keep this middle ground; after all,
implementations that don't bother to implement NAT-T and UDP
encapsulation can still work through (manually configured) static NATs
and some types of IPv4/v6 translators.

NAT_PREVENTION also creates a denial-of-service vulnerability even
when no malicious attackers are present: a misconfiguration or
introduction of a non-malicious translator causes the peers not to use
that path (and if it was the only one, connection fails).

Or as I put in my IETF63 slides, this is a "trade-off between DoS-ing
yourself and religious beliefs". In my opinion, we don't need to
settle this trade-off in the protocol spec by saying "MUST use NAT
prevention if not using NAT-T": the functionality is available for
those who really want to use it (and understanding NAT_PREVENTION is
mandatory for the responder).

Best regards,
Pasi
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Francis Dupont <[email-masked]>
Date: Fri, 09 Sep 2005 18:33:44 +0200

In your previous mail you wrote:

   
   
=> you should explain why I'd like to eliminate this "middle ground":
if none of the NAT_DETECTION_*_IP and NAT_PREVENTION is used, the
addresses in the IP header are not protected because they are not
"reflected" inside an IKE message. This opens the door at what I
call the pseudo-transient NAT attack: an attacker in the path can
patch headers in order to redirect the IPsec traffic to another node,
usually in order to flood it. (it is pseudo-NAT because it acts like
a NAT, it is transient because it has to be on the path only for some
messages)

   Any comments about this?

   
=> my concern is there can be a malicious translator. Perhaps it is
a bit paranoid but IMHO a security protocol has to be.

=> it seems you advocate for a SHOULD?

Regards

[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike