Re: Issue 41: Mandate NAT prevention if not doing NAT-T?

 In your previous mail you wrote:

   (I've split this away from issue 40.)
   
   The current version of the protocol draft does not require hosts 
   that do not support NAT-T to use the "NAT prevention" feature.
   
   Francis has suggested that this "middle ground" should be eliminated;
   in other words, the initiator would always include either
   NAT_DETECTION_*_IP (if it supports NAT-T) or NAT_PREVENTION (it it
   doesn't) in all IKE_SA_INIT and UPDATE_SA_ADDRESSES messages.
   
=> you should explain why I'd like to eliminate this "middle ground":
if none of the NAT_DETECTION_*_IP and NAT_PREVENTION is used, the
addresses in the IP header are not protected because they are not
"reflected" inside an IKE message. This opens the door at what I
call the pseudo-transient NAT attack: an attacker in the path can
patch headers in order to redirect the IPsec traffic to another node,
usually in order to flood it. (it is pseudo-NAT because it acts like
a NAT, it is transient because it has to be on the path only for some
messages)

   Any comments about this?
   
   My gut feeling is that we should keep this middle ground; after all,
   implementations that don't bother to implement NAT-T and UDP
   encapsulation can still work through (manually configured) static NATs
   and some types of IPv4/v6 translators.
   
   NAT_PREVENTION also creates a denial-of-service vulnerability even
   when no malicious attackers are present: a misconfiguration or
   introduction of a non-malicious translator causes the peers not to use
   that path (and if it was the only one, connection fails).
   
=> my concern is there can be a malicious translator. Perhaps it is
a bit paranoid but IMHO a security protocol has to be.

   Or as I put in my IETF63 slides, this is a "trade-off between DoS-ing
   yourself and religious beliefs". In my opinion, we don't need to
   settle this trade-off in the protocol spec by saying "MUST use NAT
   prevention if not using NAT-T": the functionality is available for
   those who really want to use it (and understanding NAT_PREVENTION is
   mandatory for the responder).
   
=> it seems you advocate for a SHOULD?

Regards

[email protected]