Re: Issue 59: Editorial comments from Tero (was: Commentsof draft-ietf-mobike-protocol-04.txt)

Tero Kivinen wrote:
> 
> [email protected] writes:
> > NO_NATS_ALLOWED is a bit different: since it's used only when we 
> > know beforehand that there are no NATs, so it contains the same 
> > address as the IP header -- so encrypting it does not provide
> > anything extra...
> 
> I disagree with that. How can we know there is no NAT between
> beforehand? We have not tested the path or anything, so we do not know
> if there is NAT or not. We can hope there is no NAT, as if there is
> one, then we cannot establish connection, but we cannot know anything
> about presense of NATs.
> 
> Even if our configurations says there must not be NATs between us, it
> does not mean that this is necessarely true, and it does not mean that
> we can reveal the IP-addresses to the listeners.

NO_NATS_ALLOWED means that your policy is not to use the link if it
contains a NAT. IMHO this policy implies that you're not especially
concerned about revealing your IP address.

(And like I already mentioned in the mail about issue 60, NAT Traversal
reveals the addresses, too, as is clearly said in the IKEv2 spec.)

Best regards,
Pasi