Subject: [P2PSIP] RE: [BEHAVE] RE: Endpoint-independent filtering is the way to go.

From: "Barrett, David" <[email-masked]>
Date: Wed, 18 Apr 2007 12:13:22 -0700

True, it's all in degrees.  It's just that full-cone allows for greater decentralization than restricted-cone.

For example, this works fine in a full-cone world, but doesn't work at all in a restricted:

1) My VoIP application uses STUN to find my external IP:port
2) I send you a (password:IP:port) via IM/email/postcard/psychic-link
3) You type it into your VoIP client and call me

I agree, there are other VoIP architectures that would work.  Just not this one.  And this is the one I want the internet to support.

As for the supposed security protections of restricted cone, I'll admit they're nonzero, but not by much.  For example, the only way restricted cone is at all a security risk is if there's *also* a flaw in the protocol design: 
- If the protocol is secure, then full cone is fine.
- If the protocol is insecure, then restricted cone is still inadequate.

Take the slammer example (where a child is synchronizing with a parent).  The child might be protected by a restricted cone NAT and thus inaccessible to the slammer worm.  But the parent needs to be open to the world (remember -- the children are NAT'd so the parent doesn't know the IP:port the child will use ahead of time).  Thus restricted cone is an inadequate defense in this case anyway -- maybe it protects the limbs, but the head can still be chopped off.  In the end, the only effective security is protocol security.

But yes, security also comes in degrees, and restricted cone does offer *some* degree of protection.  But at the cost of eliminating an entire class of decentralized application design by repealing the end-to-end nature of the internet?  It just seems like the cure is worse than the disease.

-david

PS: And this topic isn't limited to just IPv4 NATs.  I imagine whatever precedent we set will have strong influence over the default filtering properties of non-NAT firewalls, even as we move to IPv6.

-----Original Message-----
From: Saikat Guha [mailto:[email-masked]]
Sent: Wed 4/18/2007 2:40 AM
To: Barrett, David
Cc: [email-masked]
Subject: Re: [BEHAVE] RE: Endpoint-independent filtering  is the way to go.
 
On Tue, 2007-04-17 at 18:55 -0700, Barrett, David wrote:
> Is it safe to say that the consensus of the BEHAVE group is the
> benefit offered by decentralized overlay networks (eg, DHTs) are
> outweighed by the security risks of endpoint-independent mapping?

No. You are presupposing the solution -- that in the future no global
rendezvous service exists.

I would say, there exists at least one way where developers can achieve
*BOTH* decentralized networks *AND* secure connections. Global
rendezvous service (e.g. a SIP infrastructure much like the DNS
infrastructure today) is one such way, there may be others.

However, requiring endpoint independent filtering would be to admit
defeat / condemn the network by saying that security simply cannot be
achieved if decentralized networks is a goal. Obviously, that is wrong.

-- 
Saikat

_______________________________________________
P2PSIP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/p2psip