Re: [Patch 0/2] Avoid direct connections between NATed hosts

[Patrick McHardy <kaber@trash.net>]

Rémi Denis-Courmont wrote:
> Le vendredi 12 janvier 2007 19:20, Patrick McHardy a écrit :
> 
>>Port randomization would still be a useful feature, not to wilfully
>>break skype, but to make spoofing attacks harder. Currently we
>>undo randomization done by the operating system/application. Since
>>its optional I don't see real harm in it.
> 
> 
> Right, randomizing port numbers when they are allocated can make it 
> slightly more difficult to spoof DNS. Does the "regular" socket code 
> picks port at random or not though? And is the port allocation logic 
> shared between socket and NAT code (IMHO it should either be shared or 
> at least be equivalent)? It makes little sense to secure host behind 
> the NAT and not secure yourself; that also imples there should be no 
> need for an iptables option to enable/disable it.

Its not shared, local port allocation is quite different from NAT.

> My concern is with when (and how) Netfilter NAT code allocates a new 
> port number. If the source private-IP/port are identical, the external 
> NATed-IP/port ought be identical too, and certainly not another 
> randomized value.
> 
> With that, you have the advantage of random source port numbers (better 
> spoof protection), while not breaking any NAT-aware P2P app.

Thats impossible to guarantee, since we're mapping many address to
one we might get clashes.