Re: [BEHAVE] Very late query on stateful NAT64

[Dave Thaler <[e-mail]>]

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf
> Of Brian E Carpenter
> Sent: Thursday, October 21, 2010 3:48 PM
> To: [e-mail]
> Cc: Se-young Yu
> Subject: [BEHAVE] Very late query on stateful NAT64
> 
> Hi,
> 
> The security considerations of the RFC-to-be draft-ietf-behave-v6v4-xlate-
> stateful-12
> include this:
> 
> >    Another consideration related to NAT64 resource depletion refers to
> >    the preservation of binding state.  Attackers may try to keep a
> >    binding state alive forever by sending periodic packets that refresh
> >    the state.  In order to allow the NAT64 to defend against such
> >    attacks, the NAT64 MAY choose not to extend the session entry
> >    lifetime for a specific entry upon the reception of packets for that
> >    entry through the external interface.
> 
> How does the NAT64 distinguish between malicious keep-alives and genuine
> packets of a one-way UDP flow of some kind? We don't see how this can be
> implemented.

My understanding is that this is no different from stateful NAT44...
Many NAT44s require packets in the outbound direction in order to keep
the mapping alive.  So you can have a one-way UDP flow in the outbound
direction just fine.  But if you want a one-way UDP flow in the inbound direction,
this will time out and break unless you periodically send something in the
outbound direction.   Not all NATs do this, but some do.   Hence the MAY.

-Dave