[BEHAVE] Endpoint-Independent Mappings found to be harmful if always imposed

[Rémi Després <[e-mail]>]

Sorry for  reacting so late on draft-ietf-behave-dccp (now -04), but better late than never.

1.
REQ-1 is:
'A NAT MUST have an "Endpoint-Independent Mapping" behavior for DCCP.'

This strong statement was originally made under the assumption that external ports available in NATs were more numerous than necessary.

As sharing IPv4 global addresses becomes more and more necessary and as port utilization in hosts has evolved, this assumption is no longer appropriate everywhere.

2.
There has been a discussion in May on a possibility to authorize  more sparing an use of available ports, but without conclusion then. It is therefore appropriate to have it again now, before it is too late for the DCCP draft.

The simple idea goes that way:
"A NAT MUST have an "Endpoint-Independent Mapping" behavior for all outgoing connections except those that, because of their destination ports when the mapping is established, are known to be compatible with less port consuming mappings.
Well known ports reserved by IANA for the following applications are known to be compatible with endpoint-dependent mappings: DNS, POP3, IMAP, HTTP, HTTPS, SNMP."

Note that words are chosen so that,  although some of the  listed applications concern more TCP than DCCP,   they remain valid in the more limited scope of DCCP, and so that the sentence could apply unchanged to NAT requirements for UDP, TCP and SCTP.

3.
Concerning the DNS, the point is particularly important because of the behavior now recommended for resolvers to mitigate the *Kaminsky vulnerability*. They use a new local port for each request, each port necessitating a new mapping it each traversed NAT.

Regards,
RD

_______________________________________________
Behave mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/behave