Re: [BEHAVE] Security implications of protocol translation

[Xing Li <[e-mail]>]

Christian Huitema 写道:
>> Now, lets compare the amount of administrative overhead and routing
>> overhead:
>>
>> 1) At the translator: In the stateless case, the NAT is programmed to
>> map "a.a.a.a" to "<ISP-Prefix>:<SubnetA>:<MagicA>:a.a.a.a"; In the
>> stateful case, the NAT is programmed to map "a.a.a.a" to "<ISP-
>> Prefix>:<SubnetA>:<HostID-A>". Basically the same cost.
>>
>>
>> 2) At the host receiving the mapping: In the stateful case, the host
>> manages exactly one address, "<ISP-Prefix>:<SubnetA>:<HostID-A>"; In the
>> stateless case, the host has to be configured with two addresses, "<ISP-
>> Prefix>:<SubnetA>:<HostID-A>" and "<ISP-
>> Prefix>:<SubnetA>:<MagicA>:a.a.a.a". Somewhat more complicated.
>>
>> 3) At intermediate routers: no configuration.
>>
>> 4) In the DNS: the host A has to be configured to publish the address
>> a.a.a.a, in both cases.
>>
>> From an administrative point of view, it seems that the two solutions
>> are almost equivalent, with a slightly lesser burden for the stateful
>> scenario. The specification of the stateful is simpler, because it does
>> not require any fancy addressing format, and can use whatever host ID
>> structure is used in host A's subnet. In particular, A can use SEND.
>>     
>
>   
> To be fair, Xing's stateless proposal solves the security burden in a different way. Instead of using "<ISP-Prefix>:<SubnetA>:<MagicA>:a.a.a.a", the mapped address would be <ISP-NAT-Prefix>:a.a.a.a:padding. The analysis of configuration requirements would be:
>   

Thanks. The stateless translator (IVI) requires LIR and embed&zero-pad, 
which is discussed clearly in draft-xli-behave-v4v6-prefix-00, but 
unfortunately not very clear in draft-ietf-behave-address-format-00.txt.

> 1) At the translator: The translator is configured to map all addresses in the mapped range (say a.a.a.0/n) to the <ISP-NAT-Prefix>:a.a.a.a:padding. The only required configuration is the range of address. There is no need to configure individual addresses.
>
> 2) At the host receiving the mapping: the host has to be configured with two addresses, "<ISP-
> Prefix>:<SubnetA>:<HostID-A>" and "<ISP-NAT-Prefix>:a.a.a.a:padding". 
>   

Not correct, the IPv6 host can configure ONE IPv6 address: That is 
LIR:IPv4:SUFFIX::/128. When this host communicates with IPv6 Internet, 
the IPv6 routing system will direct the packets to the right 
destination. When this host communicates with IPv4 Internet, the IPv6 
routing system will direct the packets to the stateless translator, then 
the IPv6 packets will be converted into the IPv4 packets and sent to the 
right destination via IPv4 routing system.

BTW, please also note that "<ISP-NAT-Prefix>:a.a.a.a:padding" is a 
special subnet of "<ISP-Prefix>:<SubnetA>" . Then you will see why the 
stateless translator behaves just like an ordinary router and all the 
security BCPs can be applied to it.

>  
> 3) At intermediate routers: all intermediate routers between host A and the NAT need to install a route pointing the prefix "<ISP-NAT-Prefix>:a.a.a.a::"/n towards the host A. The last hop router, serving the domain to which A is attached, must be configured to relay these packets towards "<ISP-
> Prefix>:<SubnetA>:<HostID-A>". All intermediate routers must implement some form of egress filtering, to prevent spoofing of packets by the local NAT.
>   

Not true, see above. There is no special case here for the other 
routers, since the stateless translator behaves as an ordinary router, 
all the routes in this IPv6 network are ordinary routes.

> 4) In the DNS: the host A has to be configured to publish the address a.a.a.a, in both cases.
>   

The DNS resolver needs to know the LIR. And the IPv6 host has A record 
a.a.a.a and AAAA record LIR:a.a.a.a:SUFIX:: in the Authority DNS.

> This particular "stateless" solution does require a lesser administrative cost in the NAT. However, there is a tradeoff. The administrative cost in the intermediate routers is much higher. The solution trades a centralized management burden, in the NAT, for a distributed management burden, in the intermediate routers. I am not sure that this is the right tradeoff.
>   

Not correct, see above for reasons.

Regards,

xing


> -- Christian Huitema
>
>
>
>
>