Re: [tcpm] possible NAT support for TCP-AO

[Eric Rescorla <[e-mail]>]

At Mon, 13 Jul 2009 13:58:19 -0700,
Joe Touch wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi, all,
> 
> Based on a discussion on a different list with Dan Wing, I'd like to
> revisit thinking about NATs in the context of the current AO, which uses
> traffic keys derived from the socket pair and ISN pair. We might be able
> to now support NATs as follows, e.g.:
> 
> 	add the following flags to the MKT:
> 
> 		localNAT flag - indicates whether the local IP/port are
> 			zeroed before MAC calculation
> 
> 		remoteNAT flag - indicates whether the remote IP/port
> 			are zeroed before MAC calculation
> 
> 	add steps to the incoming/outgoing processing:
> 		zero the corresponding IP/port when the flag indicates,
> 		both on outgoing and incoming MAC calculation
> 
> That's basically it. A client behind a NAT would have a MKT with
> localNAT true, and a server for that client would need to have a MKT
> with remoteNAT true. This does require careful MKT configuration.
> Although I wouldn't expect both localNAT and remoteNAT to be true, there
> isn't a particular reason it needs to be prohibited.

So I'm going to jump in right here: it's not in general practical
to know whether you are behind a NAT. That's why the BEHAVE 
NAT discovery document is going to Experimental.

-Ekr