Subject: [BEHAVE] Source-port randomzation in Linux 2.6.21 release

From: "David Barrett" <[email-masked]>
Date: Thu, 26 Apr 2007 16:00:02 -0700

I saw the announcement that Linux 2.6.21 kernel has been released:

http://kernelnewbies.org/Linux_2_6_21

One thing that stuck out in the changelist was "NAT port randomization",
which was described later as "optional source port randomization support for
SNAT".  However, I haven't found a more accessible explanation for this.  

Can anybody explain what this is?  It sounds an awful lot like
endpoint-dependent mapping (aka, symmetric NAT), which I believe isn't
BEHAVE compliant.  Should we talk with the NetFilter guys to let them know
this and thus recommend that this new option not be used?

-david

_______________________________________________
Behave mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/behave

---

From: Lloyd Hilaiel <[email-masked]>
Date: Thu, 26 Apr 2007 16:12:31 -0700

/-- Around  4 PM on [04/26/07] ([email-masked]) "said" -- 
>this and thus recommend that this new option not be used?

sounds more to me like random port allocation behavior, but is
orthogonal to port mapping behavior.  Meaning a NAT may be "full
cone" and still allocate new ports randomly...

+#define IP_NAT_RANGE_PROTO_RANDOM 4 /* add randomness to "port" selection */

+       /* Start from random port to avoid prediction */
+       if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
+               port =  net_random();
+

best,
lloyd

-- 
[email-masked] | on taken thrive granted be never
         http://docs.yahoo.com/info/values/

---

From: "David Barrett" <[email-masked]>
Date: Thu, 26 Apr 2007 16:44:17 -0700

Ah, that's no problem then.  Thanks for clarifying.

> -----Original Message-----
> From: Lloyd Hilaiel [mailto:[email-masked]]
> Sent: Thursday, April 26, 2007 4:13 PM
> To: David Barrett
> Cc: 'IETF BEHAVE WG'
> Subject: Re: [BEHAVE] Source-port randomzation in Linux 2.6.21 release
>

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Fri, 27 Apr 2007 09:27:26 +0300

On Friday 27 April 2007 02:00:02 ext David Barrett wrote:
> Can anybody explain what this is?

> It sounds an awful lot like 

It's an option to the SNAT/MASQUERADE port that forces endpoint+port-dependant 
mapping. I DID complain on netfilter-devel when it was submitted, but nobody 
seemed to care.

http://lists.netfilter.org/pipermail/netfilter-devel/2007-January/thread.html#26612

Apparently, the point is to prevent Skype there (that's a VERY LAME way to do 
this).

-- 
Rémi Denis-Courmont

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Mon, 30 Apr 2007 09:15:08 +0300

> cone" and still allocate new ports randomly...

I haven't had a chance to try yet. But the patch submitter explicitly 
cited "blocking Skype" as the use case. As such, I presume it's randomizing 
mapped port per endpoint (à la OpenBSD).

-- 
Rémi Denis-Courmont

---

From: Saikat Guha <[email-masked]>
Date: Mon, 30 Apr 2007 03:21:39 -0400

> mapped port per endpoint (à la OpenBSD).

Hmmm, so Skype works behind non endpoint-independent NATs as well [1].
It uses TURN-like relaying for that. So the port-randomization wouldn't
block Skype.

I haven't looked at the patch, but my guess would be that they want to
block Skype from becoming a supernode (i.e. a node that relays for other
people). Port-randomization would get at that AFAIR.

That said, the randomized behavior appears to not be the default. Same
for OpenBSD's pf. Both require the administrator to explicitly invoke
the functionality, and in so doing take the NAT out of BEHAVE
compliance. 

I'd hope that the associated documentation conspicuously informs the
admin that using that setting will break many applications and will make
his NAT non-standards compliant while adding no more security than less
invasive Skype supernode prevention approaches such as payload
inspection [2]. 

[1] http://saikat.guha.cc/pub/iptps06-skype/
[2] http://www1.cs.columbia.edu/~salman/skype/index.html

-- 
Saikat