Subject: Re: FYI: New ID submission- GRP

From: [email-masked]
Date: Wed, 7 Mar 2001 16:52:53 -0500

Daniel-

I agree that Internet access might add some security risk. But, can you
explain how adding NAT to a Zero Conf net' is more risky than any other
network running NAT?

Although the intent of GRP is to allow hosts to get to
gateway routers running NAT, GRP has nothing directly to do with NAT
operation, IMHO.

Dont you think that a properly secured Zero Conf net, with proper Zero Conf
implimentations is just as secure as an RFC 1918 (private IP) network
running NAT?

Spence

Spencer Giacalone, Predictive Systems
---------------------------------------------------------------
"Nothing so much prevents our being natural
as the desire to seem so" -Francois, Duc de
La Rochefoucauld

     To:  [email-masked]
     cc:
     bcc:
     Subject:  Re: FYI: New ID submission- GRP
Daniel Senie <[email-masked]>
Sent by: [email-masked]
03/07/2001 09:38 AM
          <font size=-1></font>

Bernard Aboba wrote:
>
> And it also begs the question of why a host with a linklocal
> address should be able to "reach the Internet". Isn't the whole
> idea of linklocal addressing to avoid forwarding off link??

It also raises some questions about security. If you're building a
device that'll stay in the zeroconf address range all its life, you
might have been able to use fewer layers of security, thinking that
there'd be no interaction with the outside world. If a NAT box is now
going to interact, though, you might have to contend with incoming
connections arriving through mapping on the NAT box. While being strong
and defensive is worthwhile anyway, it does seem this proposal changes
some of the basic assumptions.

These should be carefully considered, and are certainly items which
would need to be covered in the required "Security Considerations"
section of a draft such as this one.

--
-----------------------------------------------------------------
Daniel Senie                                        [email-masked]
Amaranth Networks Inc.                    http://www.amaranth.com

---

From: Daniel Senie <[email-masked]>
Date: Wed, 07 Mar 2001 18:01:55 -0500

> explain how adding NAT to a Zero Conf net' is more risky than any other

It's not.

> gateway routers running NAT, GRP has nothing directly to do with NAT

The question is one of whether 169.254/16 will be allowed through ANY
gateway of any sort. There was quite a bit of discussion about this on
this mailing list in months past.

Relevant items include, in draft-ietf-zeroconf-ipv4-linklocal-02,
section 2.5:

   An IPv4 datagram whose source and/or destination addresses is in the
   169.254/16 range MUST NOT be sent to any router for forwarding, and
   any network device receiving such a datagram MUST NOT forward it,
   regardless of the TTL in the IP header.

NAT is a ROUTING function. The draft cited is the one which defines the
use of that address block, and we have a MUST NOT in the text there with
regards forwarding. I agree with that wording.

And later in that same section:

   The non-forwarding rule is important because it is expected that many
   link-local-only devices will be extremely simple devices of the kind
   that currently use X10 [X10], USB [USB] or FireWire [IEEE 1394].
   The designers of these devices assume that they will communicate
   only with other local devices, and implement a degree of security
   appropriate for that expected environment. 

NAT devices are NOT simply private-address to public-address mappers,
employing NAPT (one public IP address). There are many variants of NAT,
and your proposal is in conflict with the sections of the linklocal
draft.

> implimentations is just as secure as an RFC 1918 (private IP) network

Ummm, "properly configured zeroconf net"??? We're talking about nets
which do NOT need configuration! Yes, some things are likely to get
configured, but the point is by the time you're going to do
configuration, you are also in a position to define security policy, and
may well be ready to define a more complex network than is afforded by
the linklocal addressing.

---

From: "Bernard D. Aboba" <[email-masked]>
Date: Wed, 7 Mar 2001 21:26:52 -0800 (GMT-0800)

Adding NAT to a ZeroConf network is more risky because one of the major 
elements of the linklocal design is to enable devices that *only* use 
linklocal addresses. Such devices might not be able to incorporate 
security due to cost considerations. Because such devices cannot afford 
to incorporate other means of defense, adding NAT to such networks 
creates a host of security problems. 

Bottom line: Network devices MUST NOT forward or NAT packets from 
169.254/16 addresses off the link. 

Bernard "That's why they call it linklocal" Aboba