NAT Behavioral Requirements for TCP
draft-ietf-behave-tcp-08

[Ballot discuss]
In section 5, the draft suggests that NATs should man in the middle sequence number so that they can send keep alives to both sides to check liveness of the session. This works today but I wonder if the security or transport ADs see anything coming down the pipeline that is likely to break this in the future?

(Note I plan to clear this discuss as soon as we have talked about it)

[Ballot comment]
I'm not making this a discuss, but I consider it a significant
limitation that this document does not consider the implications of an
external address being used both for local traffic to the NAT and for
translated traffic.  I think the requirements for handling internal
SYNs are very challenging to deal with in this situation and guidance
would almost certainly improve implementation quality here.  I've seen
significant problems with NATs getting issues like this wrong for UDP.

[Ballot discuss]
Section 7.3., paragraph 1:
>    ICMP responses are used by end-host TCP stacks for Path MTU Discovery
>    and for quick error detection.  ICMP messages are rewritten by the
>    NAT (specifically the IP headers and the headers inside the ICMP
>    payload) and forwarded to the appropriate internal or external host.
>    Blocking any ICMP message is discouraged.

  DISCUSS: The topic of how NATs should handle ICMP messages recently
  came up again in BEHAVE in the context of draft-ietf-behave-nat-icmp.
  I'm not sure if this section accurately reflects the outcome of that
  discussion. My (personal) interpretation of the outcome is that the
  current blanket statement "blocking any ICMP message is discouraged"
  should be refined to something along these lines:

  "Several TCP mechanisms depend on the reception of ICMP error messages
  triggered by the transmission of TCP segments. One such mechanism is
  path MTU discovery [RFC1191][RFC1981], which is required for the correct
  operation of TCP. The current path MTU discovery mechanism requires
  the sender of TCP segments to be notified of ICMP "Datagram Too Big"
  responses. If a NAT translates TCP, it SHOULD translate this ICMP
  error code as well, to avoid communication failures ("black holes"
  [RFC2923]). TCP's connection establishment and maintenance mechanisms
  also behave much more efficiently when the NAT translates ICMP
  "Destination Unreachable" messages arrive in response to outgoing TCP
  segments. Consequently, NATs SHOULD translate these ICMP messages."
 
  (It may make sense to reformat this as a REQ-X.)

  I should _really_ have brought this up earlier - my apologies.

PROTO (draft-ietf-proto-wgchair-doc-shepherding-09) writeup for:

  "NAT Behavioral Requirements for TCP",
  http://www.ietf.org/internet-drafts/draft-ietf-behave-tcp-04.txt



  (1.a)  Who is the Document Shepherd for this document?  Has the
          Document Shepherd personally reviewed this version of the
          document and, in particular, does he or she believe this
          version is ready for forwarding to the IESG for publication?

Dan Wing

The document has been reviewed and is ready for forwarding to IESG for
publication.


  (1.b)  Has the document had adequate review both from key WG members
          and from key non-WG members?  Does the Document Shepherd have
          any concerns about the depth or breadth of the reviews that
          have been performed?

During its development, the document has received input from members
of the TCPM working group (especially Joe Touch and Fernando Gont), and
that input was integrated into this document.

The document had a two-week WGLC in both TCPM and BEHAVE working groups. 

There were no comments during this last call.


The Document Shepherd has no concerns about the depth or breadth of
the reviews.


  (1.c)  Does the Document Shepherd have concerns that the document
          needs more review from a particular or broader perspective,
          e.g., security, operational complexity, someone familiar with
          AAA, internationalization or XML?

Additional review is not necessary.


  (1.d)  Does the Document Shepherd have any specific concerns or
          issues with this document that the Responsible Area Director
          and/or the IESG should be aware of?  For example, perhaps he
          or she is uncomfortable with certain parts of the document, or
          has concerns whether there really is a need for it.  In any
          event, if the WG has discussed those issues and has indicated
          that it still wishes to advance the document, detail those
          concerns here.  Has an IPR disclosure related to this document
          been filed? If so, please include a reference to the disclosure
          and summarize the WG discussion and conclusion on this issue.

There have been a little concern that the TCP document normatively
references the UDP document (draft-ietf-behave-nat-udp, soon to be
published as RFC4787), because this requires reading both documents.
WG consensus was to normatively reference UDP, as is done in the
document.

There is no known IPR on this document.


  (1.e)  How solid is the WG consensus behind this document?  Does it
          represent the strong concurrence of a few individuals, with
          others being silent, or does the WG as a whole understand and
          agree with it?

The document has strong WG consensus.


  (1.f)  Has anyone threatened an appeal or otherwise indicated extreme
          discontent?  If so, please summarise the areas of conflict in
          separate email messages to the Responsible Area Director.  (It
          should be in a separate email because this questionnaire is
          entered into the ID Tracker.)

None indicated.


  (1.g)  Has the Document Shepherd personally verified that the
          document satisfies all ID nits?  (See
          http://www.ietf.org/ID-Checklist.html and
          http://tools.ietf.org/tools/idnits/).  Boilerplate checks are
          not enough; this check needs to be thorough.  Has the document
          met all formal review criteria it needs to, such as the MIB
          Doctor, media type and URI type reviews?

The document hsa pre-Feb-2007 copyright, per idnits 1.124:

  - This document has ISOC Copyright according to RFC 3978, instead of the
    newer IETF Trust Copyright according to RFC 4748.  You should consider
    updating it; the new Copyright statement will be required from February
    1st, 2007
  - This document has an original RFC 3978 Section 5.5 Disclaimer, instead
of
    the newer disclaimer which includes the IETF Trust according to RFC
4748.
    You should consider updating it; the new disclaimer will be required
from
    February 1st, 2007


  (1.h)  Has the document split its references into normative and
          informative?  Are there normative references to documents that
          are not ready for advancement or are otherwise in an unclear
          state?  If such normative references exist, what is the
          strategy for their completion?  Are there normative references
          that are downward references, as described in [RFC3967]?  If
          so, list these downward references to support the Area
          Director in the Last Call procedure for them [RFC3967].


Yes, the document has split its references. 

There are two I-Ds cited as normative: 

  * draft-ietf-behave-nat-icmp, which is not yet ready for
    advancement (it has not been WGLC'd).  It is expected to be
    WGLC'd later this year.
  * draft-ietf-behave-nat-udp is in the RFC Editor's queue.

There are no downward references.


  (1.i)  Has the Document Shepherd verified that the document IANA
          consideration section exists and is consistent with the body
          of the document?  If the document specifies protocol
          extensions, are reservations requested in appropriate IANA
          registries?  Are the IANA registries clearly identified?  If
          the document creates a new registry, does it define the
          proposed initial contents of the registry and an allocation
          procedure for future registrations?  Does it suggest a
          reasonable name for the new registry?  See
          [RFC2434.  If the document describes an Expert Review process
          has Shepherd conferred with the Responsible Area Director so that
          the IESG can appoint the needed Expert during the IESG Evaluation?

There are no IANA considerations for this specification; the document does
not describe an Expert Review process.


  (1.j)  Has the Document Shepherd verified that sections of the
          document that are written in a formal language, such as XML
          code, BNF rules, MIB definitions, etc., validate correctly in
          an automated checker?

This document does not contain any such formal language.


  (1.k)  The IESG approval announcement includes a Document
          Announcement Write-Up.  Please provide such a Document
          Announcement Write-Up?  Recent examples can be found in the
          "Action" announcements for approved documents.  The approval
          announcement contains the following sections:

          Technical Summary
This document defines a set of requirements for NATs that handle TCP
that would allow many applications, such as peer-to-peer applications
and on-line games, to work consistently.  Developing NATs that meet
this set of requirements will greatly increase the likelihood that
these applications will function properly.


          Working Group Summary
This document was a product of the BEHAVE working group.


          Document Quality
This document describes recommended practices for NATs.  Most
existing NATs already conform to these requirements.


          Personnel
Dan Wing is the Document Shepherd, and Magnus Westerlund is
the Responsible Area Director.