Subject: Re: [BEHAVE] scrambling ports - breaking SMTP and IMAP

From: "Dan Wing" <[email-masked]>
Date: Wed, 17 Dec 2008 16:15:18 -0800

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Peter Dambier
> Sent: Wednesday, November 26, 2008 12:16 PM
> To: [email-masked]
> Subject: [BEHAVE] scrambling ports - breaking SMTP and IMAP
> 
> Hello,
> 
> I am just thinking of how exim4 (sometimes) is working.
> 
> You have authenticated to IMAP.
> 
> Now you want to send outside via SMTP.
> 
> exim compares your IPv4 address with IMAP.
> If you are logged in, ok.
> 
> This wont work with port scrambling resulting in a different IPv4.

You are referring to different TCP connections getting different
IPv4 public addresses; I would call this "address scrambling", not 
port scrambling.

REQ-1 of draft-nishitani-cgn-01 says this about Large Scale NAT (LSN),
which should put your concern to rest:

   REQ-1: A LSN MUST allocate one external IP address to each CPE.

      a) LSN external IP address of the UDP, TCP and ICMP MUST be same.

-d

> Should not necessarily be a problem except when you
> replace IPv4 with IPv6.
> 
> Same goes for SMTP querying finger and ident.
> 
> There are still some people running the portmapper
> and things like NIS, rsh, rexec, rlogin, nfs,
> not to mention telnet, ftp and tftp.
> 
> After all NAT66 could be a bridge between two safe environments.
> 
> That is why port scrambling makes my hears stand on their ends.
> 
> Maybe I have missed something.
> 
> Kind regards
> Peter
> 
> -- 
> Peter and Karin Dambier
> Cesidian Root - Radice Cesidiana
> Rimbacher Strasse 16
> D-69509 Moerlenbach-Bonsweiher
> +49(6209)795-816 (Telekom)
> +49(6252)750-308 (VoIP: sipgate.de)
> mail: [email-masked]
> http://iason.site.voila.fr/
> https://sourceforge.net/projects/iason/
> http://www.cesidianroot.net/
> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/behave
> 

_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave