Subject: [secdir] SecDir Review of draft-ietf-behave-dccp-03

From: Catherine Meadows <[email-masked]>
Date: Tue, 21 Oct 2008 11:45:51 -0400

I have reviewed this document as part of the security directorate's  
ongoing effort to review all IETF documents being processed by the  
IESG. These comments were written primarily for the benefit of the  
security area directors.  Document editors and WG chairs should treat  
these comments just like any other last call comments.

This draft gives a set of behavioral requirements for network address  
translation for DCCP.
In the secure considerations section, the authors discuss the  
requirements that have security considerations,
and give recommendations.   This mostly looks in good shape, but I  
have trouble understanding the discussion of
Requirement 5 in this section.  It reads, in its entirety:

  REQ-5 recommends that a NAT that passively monitors DCCP state keep
    idle sessions alive for at least 124 minutes or 4 minutes depending
    on the state of the connection. it may attempt to actively determine
    the liveliness of a DCCP connection or let the NAT administrator
    configure more conservative timeouts.

It's unclear what the relationship is to security is here.  The  
discussion needs to make that explicit.

Some minor nits:

"problems. and" in the discussion of REQ-4 should be "problems and"

Second sentence in the discussion of REQ-5 should begin with a capital  
letter.

Catherine Meadows
Naval Research Laboratory
Code 5543
4555 Overlook Ave., S.W.
Washington DC, 20375
phone: 202-767-3490
fax: 202-404-7942
email: [email-masked]

_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir

---

From: Catherine Meadows <[email-masked]>
Date: Tue, 21 Oct 2008 16:39:00 -0400

Yes, that is much clearer.  Just one small thing:  from the wording it  
looks like it is the NAT that is letting the NAT
administrator reconfigure it.   I would instead have

To protect against denial-of-service attack filling its state storage
  capacity, a NAT
     may attempt to actively determine the liveliness of a DCCP
  connection, or  the NAT administrator could configure more  
conservative
  timeouts.

Cathy

Catherine Meadows

On Oct 21, 2008, at 12:42 PM, Rémi Denis-Courmont wrote:

> 	Hello,
>
> Le mardi 21 octobre 2008 18:45:51 Catherine Meadows, vous avez écrit :
> The text was supposed to be as follow, but the first proposition got  
> cut out
> during edition:
>
>  If a NAT is undergoing a denial-of-service attack,
>  it may attempt to actively determine the liveliness of a DCCP
>  connection or let the NAT administrator configure more conservative
>  timeouts.
>
> The wording comes from BEHAVE-TCP. I can hardly imagine the NAT  
> administrator
> rush to his NAT to reconfigure it, so this might be better... ?
>
>  To protect against denial-of-service attack filling its state storage
>  capacity, a NAT
>     may attempt to actively determine the liveliness of a DCCP
>  connection or let the NAT administrator configure more conservative
>  timeouts.
>
> Thanks for the review
>
> -- 
> Rémi Denis-Courmont
> http://git.remlab.net/cgi-bin/gitweb.cgi?p=vlc-courmisch.git;a=summary
>

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Tue, 21 Oct 2008 19:42:23 +0300

Hello,

>     configure more conservative timeouts.

The text was supposed to be as follow, but the first proposition got cut out 
during edition:

> discussion needs to make that explicit.

The wording comes from BEHAVE-TCP. I can hardly imagine the NAT administrator 
rush to his NAT to reconfigure it, so this might be better... ?

Thanks for the review