Subject: RE: [midcom] draft-ietf-midcom-requirements-01.txt

From: "Sanjoy Sen" <[email-masked]>
Date: Tue, 26 Jun 2001 10:07:04 -0500

I think having the "direction" field is useful. For cases with NAPT and SIP,
where the NAPT binding can be completed only in later phases of the session
initiation and may be changed again later, the association of a direction
parameter with the pinhole at least gives the Middle-box a sense of what
kind of address to expect to complete the NAPT binding. This gives some
added level of security.

Sanjoy  

-----Original Message-----
From: Bob Penfield [mailto:[email-masked]]
Sent: Sunday, June 24, 2001 7:30 AM
To: Melinda Shore; Andrew Molitor; midcom
Subject: Re: [midcom] draft-ietf-midcom-requirements-01.txt

----- Original Message -----
From: "Melinda Shore" <[email-masked]>
To: "Bob Penfield" <[email-masked]>; "Andrew Molitor"
<[email-masked]>; <[email-masked]>
Sent: Sunday, June 24, 2001 8:02 AM
Subject: Re: [midcom] draft-ietf-midcom-requirements-01.txt

> > In order to ensure the
> > desired packet forwarding/admission, the pin-hole would need to be
> > associated with the interface that the packets would be arriving on.
Packets
> > arriving on the other interface that happen to match the source address
> > prefix/mask for that pin-hole spec would be blocked.
>
> I think we're saying the same thing.  Given that
> we've got source addresses and destination addresses
> in the IP headers, isn't putting additional directionality
> information redundant (and potentially confusing if there
> are conflicts)?

I think you missed my point. What about a spoofed source address? Granted
that stops only one kind of attack on only one side of the middlebox. Also,
with all the multi-homing, redundant links and other kinds of complex
routing isn't it possible, if the middlebox represents the destination
address of a packet, that packets with the same source and destination could
arrive at either side. Maybe that's a stretch, but I'm not a routing expert.

If I am implementing a middlebox, being able to have a separate pin-hole
tables for each interface is more efficient. Theses boxes usually need to
operate at or near wire-speed.

(-:bob

_______________________________________________
midcom mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/midcom