Subject: Re: [BEHAVE] Comments to draft-ietf-behave-v6v4-xlate-stateful-01.txt

From: Cameron Byrne <[email-masked]>
Date: Tue, 14 Jul 2009 09:46:14 -0700 (PDT)

> Here, I think checking seq numbers is important for
> security sake, specially
> in the case of TCP RSTs.

Can you explain what the security impact is?   I assume the security impact you are concerned about is that a 3rd part can send RST to kill the binding and effectively DOS the NAT box.  Since this is stateful NAT, the binding will have both source and destination, and consequently only  only the source and destination should be able to modify that binding with a RST, no sequence numbers required.

Cameron Byrne
Principal Engineer
T-Mobile USA

---

From: Reinaldo Penno <[email-masked]>
Date: Tue, 14 Jul 2009 15:57:18 -0400

If I understand you correctly, the issue here is spoofed packets. There are
seq/ack checking you should perform to make sure the RST is valid.

On 7/14/09 9:46 AM, "Cameron Byrne" <[email-masked]> wrote:

> Can you explain what the security impact is?   I assume the security impact
> you are concerned about is that a 3rd part can send RST to kill the binding
> and effectively DOS the NAT box.  Since this is stateful NAT, the binding will
> have both source and destination, and consequently only  only the source and
> destination should be able to modify that binding with a RST, no sequence
> numbers required.
> 
> Cameron Byrne
> Principal Engineer
> T-Mobile USA