Subject: [Ietf-behave] DNS ALG, REQ-9

From: "Dan Wing" <[email-masked]>
Date: Mon, 15 Aug 2005 18:40:53 -0700 (PDT)

-ietf-behave-nat-udp-03 reads:

   REQ-9: If a NAT includes ALGs, it is RECOMMENDED that all of those
      ALGs (except for DNS [19] and FTP [18]) be disabled by default.

This implies the converse -- that a DNS ALG SHOULD be enabled.  Is that the
intention of your text?  

I understand the FTP ALG, it's well described in section 7.1 of RFC2663.
However, I don't understand what the DNS ALG is supposed to do especially in
a Dlink/Netgear/Linksys-class device; section 4.3 of RFC2663 implies it
would only be necessary if you're doing "twice NAT" (see RFC2663 for
details) and only during pure NAT (that is, not doing port address
translation).

I would like a better explanation of the intended function of the DNS ALG in
-ietf-behave-nat-udp-, or a cite to a specific section and RFC.  I'm
concerned the existing text might cause proliferation of DNSSEC-breaking DNS
ALG functions in seldom-upgraded consumer NATs.

-d

---

From: "Francois Audet" <[email-masked]>
Date: Tue, 16 Aug 2005 09:09:51 -0700 (PDT)

I don't remember why we put DNS in there.

Srisuresh, was it you that requested it?

PS: I will add the reference to 7.1/RFC 2663 for FTP ALG.

> -----Original Message-----
> From: ietf-behave-bounces@xxxxxxxxxxxxxxxxxxx 
> [mailto:ietf-behave-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of Dan Wing
> Sent: Monday, August 15, 2005 18:41
> To: ietf-behave@xxxxxxxxxxxxxxxxxxx
> Subject: [Ietf-behave] DNS ALG, REQ-9
> 
> 
> This implies the converse -- that a DNS ALG SHOULD be 
> enabled.  Is that the intention of your text?  
> 
> I understand the FTP ALG, it's well described in section 7.1 
> of RFC2663. However, I don't understand what the DNS ALG is 
> supposed to do especially in a Dlink/Netgear/Linksys-class 
> device; section 4.3 of RFC2663 implies it would only be 
> necessary if you're doing "twice NAT" (see RFC2663 for
> details) and only during pure NAT (that is, not doing port 
> address translation).
> 
> I would like a better explanation of the intended function of 
> the DNS ALG in -ietf-behave-nat-udp-, or a cite to a specific 
> section and RFC.  I'm concerned the existing text might cause 
> proliferation of DNSSEC-breaking DNS ALG functions in 
> seldom-upgraded consumer NATs.
> 
> -d
> _______________________________________________
> Ietf-behave mailing list
> Ietf-behave@xxxxxxxxxxxxxxxxxxx 
> https://list.sipfoundry.org/mailman/listinfo/ietf-behave
> 
>

---

From: "Francois Audet" <[email-masked]>
Date: Thu, 18 Aug 2005 08:01:33 -0700 (PDT)

Same  here, the residential/branch NATs and the large Corporate 
NATs that I looked at do not support DNS ALGs (they do FTP ALGs
of course).

I agree about the point on FTP.

I think we need to change REQ-9 to something like:

   REQ-9: If a NAT includes ALGs that affect UDP, it is RECOMMENDED 
          that all of those ALGs be disabled by default.
      a) If a NAT includes ALGs, it is RECOMMENDED that the NAT allow
         the NAT administrator to enable or disable each ALG separately.

> From: Dan Wing [mailto:dwing@xxxxxxxxx] 
> Sent: Wednesday, August 17, 2005 18:40
> To: 'Kaushik Biswas (kbiswas)'; Audet, Francois 
> [SC100:9T51:EXCH]; ietf-behave@xxxxxxxxxxxxxxxxxxx
> Subject: RE: [Ietf-behave] DNS ALG, REQ-9
> 
> 
> > It was an outcome of the IETF 62 (Minneapolis) discussions 
> whereby it 
> > was felt that FTP & DNS ALGs turning off won't be acceptable.
> 
> Umkay.  But the basis for that decision seems to have been 
> lost to history.
> 
> I want additional text added to the document explaining what 
> a DNS ALG is supposed to do, and not supposed to do.  As it 
> is, the BEHAVE 
> document doesn't cite what behavior it's recommending a DNS 
> ALG to perform.  I am questioning the need for a DNS ALG at 
> all considering that I can't find that the major 
> consumer-grade NAT manufacturers don't seem to include it as 
> a feature (I checked Linksys, D-Link, and 
> Netgear).  It seems only useful if you're doing NAT in the 
> truest sense of NAT -- that is, you're only rewriting IP 
> addresses and you're not rewriting ports and not overloading 
> ports (NAPT).
> 
> > BTW IMO behave-udp draft shouldn't be talking about FTP in 
> the first 
> > place. If we are talking about FTP in behave-udp draft then 
> we should 
> > also putting a cross reference to 
> > draft-sivakumar-behave-nat-tcp-req-01's Sections: 4.2 & 4.3.
> 
> Good point - the UDP document shouldn't talk about an FTP ALG.
> 
> -d
> 
> 
> > Thanks,
> > Kaushik
> > 
> > > [mailto:ietf-behave-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of 
> > > Francois Audet
> > > Sent: Tuesday, August 16, 2005 9:11 AM
> > > To: Dan Wing (dwing); ietf-behave@xxxxxxxxxxxxxxxxxxx
> > > Subject: RE: [Ietf-behave] DNS ALG, REQ-9
> > > 
> > > > I understand the FTP ALG, it's well described in section 7.1 of
> > > > RFC2663. However, I don't understand what the DNS ALG is 
> > > supposed to
> > > > do especially in a Dlink/Netgear/Linksys-class device;
> > > section 4.3 of
> > > > RFC2663 implies it would only be necessary if you're doing
> > > "twice NAT"
> > > > (see RFC2663 for
> > > > I would like a better explanation of the intended function
> > > of the DNS
> > > > ALG in -ietf-behave-nat-udp-, or a cite to a specific
> > > section and RFC.
> > > > I'm concerned the existing text might cause proliferation of
> > > > DNSSEC-breaking DNS ALG functions in seldom-upgraded 
> > consumer NATs.
> > > > 
> > > > -d