IETF Logo Mail Archive

Re: Last Call: RFC 6346 successful: moving to Proposed Standard

Ted Lemon <Ted.Lemon@nominum.com> Thu, 11 December 2014 01:32 UTC

Return-Path: <Ted.Lemon@nominum.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DCC941A1B8F for <ietf@ietfa.amsl.com>; Wed, 10 Dec 2014 17:32:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Level:
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TxUplt2lMVAe for <ietf@ietfa.amsl.com>; Wed, 10 Dec 2014 17:32:29 -0800 (PST)
Received: from sjc1-mx02-inside.nominum.com (sjc1-mx02-inside.nominum.com [64.89.234.25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E21431A1B4B for <ietf@ietf.org>; Wed, 10 Dec 2014 17:32:29 -0800 (PST)
Received: from archivist.nominum.com (archivist.nominum.com [64.89.228.108]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.nominum.com", Issuer "Go Daddy Secure Certificate Authority - G2" (verified OK)) by sjc1-mx02-inside.nominum.com (Postfix) with ESMTPS id 0A6F4DA0104 for <ietf@ietf.org>; Thu, 11 Dec 2014 01:32:54 +0000 (UTC)
Received: from webmail.nominum.com (cas-01.win.nominum.com [64.89.228.131]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (Client CN "mail.nominum.com", Issuer "Go Daddy Secure Certificate Authority - G2" (verified OK)) by archivist.nominum.com (Postfix) with ESMTP id 66FA253E076; Wed, 10 Dec 2014 17:31:59 -0800 (PST)
Received: from [10.0.20.107] (71.233.43.215) by CAS-01.WIN.NOMINUM.COM (192.168.1.100) with Microsoft SMTP Server (TLS) id 14.3.195.1; Wed, 10 Dec 2014 17:31:59 -0800
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
Subject: Re: Last Call: RFC 6346 successful: moving to Proposed Standard
From: Ted Lemon <Ted.Lemon@nominum.com>
In-Reply-To: <CADC+-gR+sFUELOrdfVj5e3hW-KZoftotbhvEwF6aotZvq5wOkw@mail.gmail.com>
Date: Wed, 10 Dec 2014 20:31:13 -0500
Content-Transfer-Encoding: quoted-printable
Message-ID: <1DF3E368-D915-458C-8009-C508735D3C88@nominum.com>
References: <20141201223832.20448.34524.idtracker@ietfa.amsl.com> <A4CFF3FB-A9C5-47EA-A1CA-B900CDBF776E@gmail.com> <547F451C.3010507@dcrocker.net> <D0AE1053.7AA8A%Lee@asgard.org> <AF1B977B-75D4-4AF2-B231-300AF2429317@nominum.com> <CAMm+Lwji9860CKaJB_9xi3ztiVUtP3NZ8AgO1wZAVTKVWW76Nw@mail.gmail.com> <CADC+-gR+sFUELOrdfVj5e3hW-KZoftotbhvEwF6aotZvq5wOkw@mail.gmail.com>
To: Doug Royer <douglasroyer@gmail.com>
X-Mailer: Apple Mail (2.1878.6)
X-Originating-IP: [71.233.43.215]
Archived-At: http://mailarchive.ietf.org/arch/msg/ietf/fKU-4YOaDg6PQ_DYTb6XujbRy0c
Cc: IETF Discussion Mailing List <ietf@ietf.org>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 11 Dec 2014 01:32:31 -0000

On Dec 10, 2014, at 7:39 PM, Doug Royer <douglasroyer@gmail.com> wrote:
> What about legacy software that decides what port it is going to use?
> Well their packets go to the wrong hardware? Seems a BIG security hold to me.

This is equivalent to the current practice of giving a home gateway an IP address with all 64k ports.   These ports are _already_ shared by devices behind the NAT.   The difference with port sharing is just that you start out with fewer than 64k ports.   Legacy software of the type you describe already doesn't work with a NAT.

v2.23.0 | Report a Bug | By Email