Subject: [Ietf-behave] draft-ietf-behave-nat-udp-01, REQ-7

From: "Francois Audet" <[email-masked]>
Date: Wed, 25 May 2005 11:26:15 -0700 (PDT)

Man, this is difficult....

We have the following proposals on the table:

REQ-7: Favored by Bryan, Sriruresh, Yutaka

        NATs SHOULD support Endpoint Independent Filtering and Address 
        Dependent Filtering, and MAY support Address and Port Dependent 
        Filtering, as options configurable by the user. It is RECOMMENDED 
        that Endpoint Independent Filtering be the default.

  Cullen strongly opposes the last sentence, and the configuration
  option.

REQ-7: Favored by Cullen (as co-author, not chair), and maybe others

        A NAT should support Endpoint Independent Filtering 
        or Address and Port Dependent Filtering.

I am not sure if Bryan strongly opposes Cullen's proposal, or if he
mildly opposes it.

I'm not sure either what are Christian and Jon's preferences at this point.

Personally, I don't really care as I believe the justification
(below) is more important since there is no MUST. I do have a mild 
preference for Cullen's.

REQ-7 justification:

        The recommendation to use Endpoint Independent Filtering is aimed at maximizing 
        application transparency, in particular for applications that receive media 
        simultaneously from multiple locations (e.g., gaming), or applications that use
        rendezvous techniques. However, it is also possible that in some circumstances, it 
        may be preferable to have a more stringent filtering behavior. Filtering 
        independently of the external endpoint is not as secure: an unauthorized packet 
        could get a specific port while the port was kept open if it was lucky enough to 
        find the port open. In theory, filtering based on both IP address and port is more 
        secure than filtering based only on the IP address (because the external endpoint 
        could in reality be two endpoints behind another NAT, where one of the two 
        endpoints is an attacker): however, such a policy could interfere with 
        applications that expect to receive UDP packets on more than one UDP port. 
        Using Endpoint Independent Filtering or Address Dependent Filetering instead of
        Address and Port Dependent Filtering on a NAT (say NAT-A) also has benefits 
        when the other enpoint is behind a non-BEHAVE compliant NAT (say NAT-B) which 
        doesn't support REQ-1. When the endpoints use ICE, if NAT-A uses Address and Port 
        Dependent Filtering, connectivity will require a Media Relay. However, if NAT-A 
        uses Endpoint Indepent Filtering or Address Dependent Filtering, ICE will 
        ultimately find connectivity without requiring a Media Relay.

I believe we have a rough concensus on the justification text above. It makes it
clear why you would choose one or the other.

My proposal:

- Adopt Cullen's text. However, include in the justification, the following text:

        A NAT vendor could could satisfy the maximum application transparency 
        requirement versus the maximum security requirement by having a configuration
        option allowing choosing between, respectively, Endpoint Independent Filtering
        and Address Dependent Filtering.

If this proposal fails, then I'm not sure what to do. Seems to me we've beaten this
to death and we might need a Chair or AD make a decision...

---

From: Cullen Jennings <[email-masked]>
Date: Wed, 25 May 2005 20:01:35 -0700 (PDT)

I'm in agreement with that. (and fix my typo s/should/SHOULD/ )

On 5/25/05 11:25 AM, "Francois Audet" <audet@xxxxxxxxxx> wrote:

REQ-7 justification: 

My proposal:

---

From: Pyda Srisuresh <[email-masked]>
Date: Thu, 26 May 2005 09:14:44 -0700 (PDT)

Francois,

The following would work for me.

        NATs MUST support one of Endpoint Independent Filtering or
        Endpoint Address Dependent Filtering for UDP sessions by default. 
        A NAT device is RECOMMENDED to have filtering behavior for UDP
        available as a configurable option amongst a) endpoint dependent
        filtering, b) Endpoint address dependent filtering, and c) Endpoint 
        independent filtering.
       
        In the case a NAT device is configured to support Endpoint Address
        dependent filtering, it is RECOMMENDED that the NAT device has
provision
        to selectively enable endpoint independent filtering for applications 
        that benefit from the option.

cheers,
suresh

--- Francois Audet <audet@xxxxxxxxxx> wrote:

> > _______________________________________________
> Ietf-behave mailing list
> Ietf-behave@xxxxxxxxxxxxxxxxxxx
> https://list.sipfoundry.org/mailman/listinfo/ietf-behave
>

---

From: [email-masked]
Date: Thu, 26 May 2005 11:18:15 -0700 (PDT)

I am ok with this, too..
assuming that Fancois meant:
REQ-7:
  A NAT SHOULD support Endpoint Independent Filtering
  or Address Dependent Filtering.
Observing the arguments, it is convincing me that the arguments on the
default filtering behavior is not a behave's primary goal, nothing more
than just an option for router developers to choose. (as well as other
firewall options which are out of scope of behave, which how I view)
REQ-1, 3, 5, 6, 8 already cover the most important aspects of NAT
behavior for us to design applications in a deterministic manner.
REQ-7 justification looks very good to me. Especially, that
Endpoint-specific filtering is not a recommendation and mentioning in
the justification the benefit of the recommendation in REQ-7 with using 
ICE is very important for us to reduce requirement to a media relay,
particularly in the transition to full deployment of behave compliant NATs.

- Yutaka

Cullen Jennings wrote:

            Filtering, as options configurable by the user. It is
    RECOMMENDED

    I'm not sure either what are Christian and Jon's preferences at this
    point.

            The recommendation to use Endpoint Independent Filtering is
    aimed at maximizing
            application transparency, in particular for applications
    that receive media
            simultaneously from multiple locations (e.g., gaming), or
    applications that use
            rendezvous techniques. However, it is also possible that in
    some circumstances, it
            may be preferable to have a more stringent filtering
    behavior. Filtering
            independently of the external endpoint is not as secure: an
    unauthorized packet
            could get a specific port while the port was kept open if it
    was lucky enough to
            find the port open. In theory, filtering based on both IP
    address and port is more
            secure than filtering based only on the IP address (because
    the external endpoint
            could in reality be two endpoints behind another NAT, where
    one of the two
            endpoints is an attacker): however, such a policy could
    interfere with
            applications that expect to receive UDP packets on more than
    one UDP port.
            Using Endpoint Independent Filtering or Address Dependent
    Filetering instead of
            Address and Port Dependent Filtering on a NAT (say NAT-A)
    also has benefits
            when the other enpoint is behind a non-BEHAVE compliant NAT
    (say NAT-B) which
            doesn't support REQ-1. When the endpoints use ICE, if NAT-A
    uses Address and Port
            Dependent Filtering, connectivity will require a Media
    Relay. However, if NAT-A
            uses Endpoint Indepent Filtering or Address Dependent
    Filtering, ICE will
            ultimately find connectivity without requiring a Media Relay.
    I believe we have a rough concensus on the justification text above.
    It makes it
    clear why you would choose one or the other.
    My proposal:

    - Adopt Cullen's text. However, include in the justification, the
    following text:
            A NAT vendor could could satisfy the maximum application
    transparency
            requirement versus the maximum security requirement by
    having a configuration
            option allowing choosing between, respectively, Endpoint
    Independent Filtering
            and Address Dependent Filtering.
    If this proposal fails, then I'm not sure what to do. Seems to me
    we've beaten this
    to death and we might need a Chair or AD make a decision...

------------------------------------------------------------------------