Re: [Ntp] Rate limiting: DDoS, KoD, Pool, NAT

[Philip Prindeville <[e-mail]>]

> On Dec 8, 2020, at 11:03 AM, Hal Murray <[e-mail]> wrote:
> 
> 
> [e-mail] said:
>> My point was that the address stuffed into the cookie/nonce would mismatch
>> the address in the source address of the IP packet once it got SNAT’d.
> 
>> It sounded like you were tacitly counting on the two being a match. 
> 
> I think it works, but maybe I'm missing something.
> 
> Server behind NAT box:
>  Server gets clients correct IP Address which goes into the cookie.
>  When the cookie comes back, it has the same IP Address and matches.
> 
> Client behind NAT box:
>  Server gets address of NAT box.  That goes into cookie.


Not necessarily.  Most services are oblivious to the fact that they’re being NATted.  I don’t think this should be any different.


>  When the cookie comes back, it has the same address (NAT box) and matches.
> 
> Note that "IP Address" in the above does not include the port number.
> 
> I think the key idea is that both ends don't have to agree on what the IP 
> Address is.  The server both inserts the IP Address into the cookie and checks 
> it when the cookie comes back.  As long as the packet comes from the same NAT 
> box things will match.
> 
> If there are multiple clients behind the NAT box, one of them could use his 
> cookies to DoS another system behind the same NAT box.
> 
>