Subject: [NSIS] Last Call: 'GIST: General Internet Signaling Transport' to Proposed Standard (draft-ietf-nsis-ntlp)

From: The IESG <[email-masked]>
Date: Thu, 27 Jul 2006 11:08:01 -0400

The IESG has received a request from the Next Steps in Signaling WG to consider
 
the following document:

- 'GIST: General Internet Signaling Transport '
   <draft-ietf-nsis-ntlp-10.txt> as a Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action.  Please send any comments to the
[email-masked] or [email-masked] mailing lists by 2006-08-10.

The file can be obtained via
http://www.ietf.org/internet-drafts/draft-ietf-nsis-ntlp-10.txt

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Roland Bless <[email-masked]>
Date: Fri, 28 Jul 2006 17:31:50 +0200

Hi Robert,

[while playing around with our implementation, I reread
parts of the current NTLP draft after a long time...and I have
two -- maybe very silly/basic questions]:
A)
Possibly I missed the part in the draft, but is there any clear
specification where exactly the RESPONSE must be sent in D-Mode
(no MA-reuse)? I found only the following statements which
are IMHO not very explicit about the exact destination:

"A Query always triggers a Response in
   the reverse direction as the second message of the handshake."

"No Association: No MA exists.  GN2 sends the Response in D-mode
directly to GN1, identifying itself and agreeing to the
association setup."

"Query MUST elicit a Response.  This is a normally encapsulated D-mode
   message with additional payloads."

and the "best hint" is in sec. 5.2.2 / NLI:

     The interface-address must be routable, i.e. it MUST be usable as
      a destination IP address for packets to be sent back to the node
      generating the signaling message, whether in D-mode or C-mode.

though it doesn't specify something about which destination
address must be used for responses (and it would not be the
appropriate section for this).

The example in fig.11 shows that the NLI i/f address
is used in the response.

(The alternative to use the NLI address would be
sending it back to the source in case of a set S-flag,
but I guess that's not what the spec intends...)

However, I would really like to see a clear statement like:
GN2 sends the Response in D-mode directly to GN1, using
the interface-address as destination addess as specified
in the NLI of the query and the source port of the query
as destination port of the response.

B)
if the response must be sent back to what is specified in the
NLI, this possibly opens up reflection attacks. This should be
mentioned in the security considerations section and I'm not quite
sure whether any sanity checks are possible to prevent this.

Regards,
 Roland