Subject: Re: [BEHAVE] RE: SecDir review of draft-ietf-behave-tcp-05

From: Cullen Jennings <[email-masked]>
Date: Sun, 1 Apr 2007 15:30:14 -0700

Sounds reasonable to me

On Mar 25, 2007, at 5:40 PM, Saikat Guha wrote:

> On Thu, 2007-03-22 at 10:21 +0200, [email-masked] wrote:
>> No, but for translation of TCP to work, NATs are required to handle
>> sequence numbers in correct fashion (just like NATs are required to
>> handle TCP state machine correctly, REQ-2).
>
> Fair enough. ALGs aside, not supporting SACK when the NAT is munging
> seq# for privacy reasons can be viewed as an information leak.
>
> Perhaps adding the following sentence to the security section would
> help:
>
>   "NAT implementations that modify TCP sequence numbers for privacy
>    reasons or ALG support must ensure that TCP packets with SACK
>    notifications are properly handled."
>
> Thoughts?
>
> cheers,
> -- 
> Saikat
> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/behave

_______________________________________________
Behave mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/behave

---

From: "Dave Hudson" <[email-masked]>
Date: Thu, 22 Mar 2007 11:12:21 -0700

* -----Original Message-----
* From: [email-masked] [mailto:[email-masked]] 
* Sent: 22 March 2007 08:21
* To: [email-masked]; [email-masked]
* Subject: [BEHAVE] RE: SecDir review of draft-ietf-behave-tcp-05
* 
* No, but for translation of TCP to work, NATs are required to 
* handle sequence numbers in correct fashion (just like NATs 
* are required to handle TCP state machine correctly, REQ-2). 
* 
* I think prohibiting behavior known to break TCP, which is 
* known to be implemented by some NATs, should be in scope.  
* NAT implementors may not realize that incorrectly implemented 
* seq# rewriting actually breaks things... and even if SACK is 
* handled correctly, it breaks the ability to add certain kinds 
* of options to TCP later. So actually NOT rewriting TCP seq# 
* is required for future-proof correct translation of TCP.
* 
* IMHO this document should alert NAT implementors that seq# 
* rewriting is difficult to implement correctly today, and 
* impossible to implement correctly in a future-proof way. I'm 
* not suggesting any extensive changes; five lines or something 
* should be quite enough.

Of course we have to be careful here not to add wording that prevents
necessary rewriting of sequence numbers.  Many text-based protocol ALGs
have to do this (e.g. FTP).

Regards,
Dave

---

From: "Dan Wing" <[email-masked]>
Date: Wed, 4 Apr 2007 09:12:30 -0700

> -----Original Message-----
> From: Saikat Guha [mailto:[email-masked]] 
> Sent: Sunday, March 25, 2007 5:40 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [BEHAVE] RE: SecDir review of draft-ietf-behave-tcp-05
> 

Please make the "for privacy reasons" an example, like this:

   "NAT implementations that modify TCP sequence numbers (e.g., for 
    privacy reasons) or ALG support must ensure that TCP packets with SACK
    notifications are properly handled."

(Sorry for my delay, I just returned from a 10-day vacation.)

-d