Subject: [Ietf-behave] Issues with draft-ietf-behave-rfc3489bis-01

From: Paul Hoffman <[email-masked]>
Date: Mon, 9 May 2005 14:52:19 -0700 (PDT)

Greetings again. In looking over the STUNbis draft, two issues popped up.

In section 8.1, it says:

      OPEN ISSUE: Experience has shown that the usage of a dynamic port
      for P2 has been problematic.  This is because firewall
      administrators have opened up port 3478 to permit STUN, but
      disallowed the dynamic port used by the server.  This causes the
      diagnostic techniques to fail.  This can be fixed through
      allocation of a second port number from IANA.  Does that belong in
      this specification or in the diagnostic specification? I think it
      has to go here.
Agree, it should go here, particularly because there doesn't appear 
to be a diagnostic spec (yet).

Later in 8.1, it says:

   If the RESPONSE-ADDRESS attribute was absent from the Binding
   Request, the destination address and port of the Binding Response
   MUST be the same as the source address and port of the Binding
   Request.  Otherwise, the destination address and port of the Binding
   Response MUST be the value of the IP address and port in the
   RESPONSE-ADDRESS attribute.
This means that a compliant STUN server MUST support sending STUN 
responses to someone who didn't ask for them; that's pretty bad from 
a DoS standpoint. The server should be allowed to ignore requests 
that have a RESPONSE-ADDRESS that differs from the source address of 
the Binding Request. Also, this really should be covered in the 
Security Considerations section.

--Paul Hoffman, Director
--Cybersecurity Association