(08) icmp

.duvet/config.toml

@@ -17,3 +17,6 @@ enabled = true
 
 [[specification]]
 source = "https://www.rfc-editor.org/rfc/rfc4787"
+
+[[specification]]
+source = "https://www.rfc-editor.org/rfc/rfc5508"

.duvet/requirements/www.rfc-editor.org/rfc/rfc5508/section-10.toml

@@ -0,0 +1,12 @@
+target = "https://www.rfc-editor.org/rfc/rfc5508#section-10"
+
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+Blocking such ICMP messages is
+known to break some protocol features (most notably path MTU
+Discovery) and some applications (e.g., ping, traceroute), and such
+blocking is NOT RECOMMENDED.
+'''
+

.duvet/requirements/www.rfc-editor.org/rfc/rfc5508/section-3.1.toml

@@ -0,0 +1,59 @@
+target = "https://www.rfc-editor.org/rfc/rfc5508#section-3.1"
+
+
+[[spec]]
+level = "MUST"
+quote = '''
+Unless explicitly overridden by local policy, a NAT device MUST
+permit ICMP Queries and their associated responses, when the Query is
+initiated from a private host to the external hosts.
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+NAT mapping of ICMP Query Identifiers SHOULD be external-host
+independent.
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+If host
+A reused the Query Id X to send ICMP Queries to the same or different
+external host, the NAT device SHOULD reuse the same Query Id mapping
+(i.e., map the private host's Query Id X to Query Id X' on NAT's
+public IP address) instead of assigning a different mapping.
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+Below is justification for making the endpoint-independent mapping
+for ICMP Query Id a SHOULD [RFC2119] requirement.
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+Given the dichotomy between legacy applications not
+requiring endpoint-independent mapping and future applications that
+might require it, the requirement level is kept at SHOULD [RFC2119].
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+REQ-1: Unless explicitly overridden by local policy, a NAT device
+MUST permit ICMP Queries and their associated responses, when
+the Query is initiated from a private host to the external
+hosts.
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+a) NAT mapping of ICMP Query Identifiers SHOULD be external-
+host independent.
+'''
+

.duvet/requirements/www.rfc-editor.org/rfc/rfc5508/section-3.2.toml

@@ -0,0 +1,30 @@
+target = "https://www.rfc-editor.org/rfc/rfc5508#section-3.2"
+
+
+[[spec]]
+level = "MUST"
+quote = '''
+An ICMP Query session timer MUST NOT expire in less than 60 seconds.
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+It is RECOMMENDED that the ICMP Query session timer be made
+configurable.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+REQ-2: An ICMP Query session timer MUST NOT expire in less than 60
+seconds.
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+a) It is RECOMMENDED that the ICMP Query session timer be made
+configurable.
+'''
+

.duvet/requirements/www.rfc-editor.org/rfc/rfc5508/section-4.1.toml

@@ -0,0 +1,85 @@
+target = "https://www.rfc-editor.org/rfc/rfc5508#section-4.1"
+
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+When an ICMP Error packet is received, if the
+ICMP checksum fails to validate, the NAT SHOULD silently drop the
+ICMP Error packet.
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+For this reason, if the IP checksum of the embedded
+packet within an ICMP Error message fails to validate, the NAT SHOULD
+silently drop the Error packet.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+Specifically, if the embedded packet includes
+IP options, the NAT device MUST traverse past the IP options to
+locate the start of transport header for the embedded packet.
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+A NAT device SHOULD NOT validate the transport checksum of the
+embedded packet within an ICMP Error message, even when it is
+possible to do so.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+In the case that the ICMP Error payload includes ICMP extensions
+[ICMP-EXT], the NAT device MUST exclude the optional zero-padding and
+the ICMP extensions when evaluating transport checksum for the
+embedded packet.
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+REQ-3: When an ICMP Error packet is received, if the ICMP checksum
+fails to validate, the NAT SHOULD silently drop the ICMP Error
+packet.
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+a) If the IP checksum of the embedded packet fails to
+validate, the NAT SHOULD silently drop the Error packet;
+and
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+b) If the embedded packet includes IP options, the NAT device
+MUST traverse past the IP options to locate the start of
+the transport header for the embedded packet; and
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+c) The NAT device SHOULD NOT validate the transport checksum
+of the embedded packet within an ICMP Error message, even
+when it is possible to do so; and
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+d) If the ICMP Error payload contains ICMP extensions
+[ICMP-EXT], the NAT device MUST exclude the optional zero-
+padding and the ICMP extensions when evaluating transport
+checksum for the embedded packet.
+'''
+

.duvet/requirements/www.rfc-editor.org/rfc/rfc5508/section-4.2.1.toml

@@ -0,0 +1,45 @@
+target = "https://www.rfc-editor.org/rfc/rfc5508#section-4.2.1"
+
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+If the NAT device does not have an
+active mapping for the embedded packet, the NAT SHOULD silently drop
+the ICMP Error packet.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+Otherwise, the NAT device MUST use the
+matching NAT Session to translate the embedded packet; that is,
+translate the source IP address of the embedded packet (e.g., Host-y'
+-> Host-y) and transport headers.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+The NAT device MUST also use the matching NAT Session to translate
+the destination IP address in the outer IP header.
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+REQ-4: If a NAT device receives an ICMP Error packet from an external
+realm, and the NAT device does not have an active mapping for
+the embedded payload, the NAT SHOULD silently drop the ICMP
+Error packet.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+If the NAT has active mapping for the embedded
+payload, then the NAT MUST do the following prior to
+forwarding the packet, unless explicitly overridden by local
+policy:
+'''
+

.duvet/requirements/www.rfc-editor.org/rfc/rfc5508/section-4.2.2.toml

@@ -0,0 +1,62 @@
+target = "https://www.rfc-editor.org/rfc/rfc5508#section-4.2.2"
+
+
+[[spec]]
+level = "MUST"
+quote = '''
+When the NAT device receives the ICMP Error packet, the NAT device
+MUST use the packet embedded within the ICMP Error message (i.e., the
+IP packet from Host-x to Host-y) to look up the NAT Session to which
+the embedded packet belongs.
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+If the NAT device does not have an
+active mapping for the embedded packet, the NAT SHOULD silently drop
+the ICMP Error packet.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+Otherwise, the NAT device MUST use the
+matching NAT Session to translate the embedded packet.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+So, if the NAT device has active mapping for the
+IP address of the intermediate node Router-y, the NAT device MUST
+translate the source IP address of the ICMP Error packet with the
+public IP address in the mapping.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+In all other cases, the NAT device
+MUST simply use its own IP address in the external domain to
+translate the source IP address.
+'''
+
+[[spec]]
+level = "SHOULD"
+quote = '''
+REQ-5: If a NAT device receives an ICMP Error packet from the private
+realm, and the NAT does not have an active mapping for the
+embedded payload, the NAT SHOULD silently drop the ICMP Error
+packet.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+If the NAT has active mapping for the embedded
+payload, then the NAT MUST do the following prior to
+forwarding the packet, unless explicitly overridden by local
+policy:
+'''
+

.duvet/requirements/www.rfc-editor.org/rfc/rfc5508/section-4.3.toml

@@ -0,0 +1,21 @@
+target = "https://www.rfc-editor.org/rfc/rfc5508#section-4.3"
+
+
+[[spec]]
+level = "MUST"
+quote = '''
+While processing an ICMP Error packet pertaining to an ICMP Query or
+Query response message, a NAT device MUST NOT refresh or delete the
+NAT Session that pertains to the embedded payload within the ICMP
+Error packet.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+REQ-6: While processing an ICMP Error packet pertaining to an ICMP
+Query or Query response message, a NAT device MUST NOT refresh
+or delete the NAT Session that pertains to the embedded
+payload within the ICMP Error packet.
+'''
+

.duvet/requirements/www.rfc-editor.org/rfc/rfc5508/section-5.toml

@@ -0,0 +1,51 @@
+target = "https://www.rfc-editor.org/rfc/rfc5508#section-5"
+
+
+[[spec]]
+level = "MUST"
+quote = '''
+Specifically,
+NAT devices enforcing Basic NAT [NAT-TRAD] MUST support the traversal
+of hairpinned ICMP Query sessions.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+All NAT devices (i.e., Basic NAT as well as NAPT
+devices) MUST support the traversal of hairpinned ICMP Error
+messages.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+In addition, the NAT device MUST translate the destination
+IP address of the outer IP header to be same as the source IP address
+of the embedded IP packet after the translation.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+REQ-7: NAT devices enforcing Basic NAT [NAT-TRAD] MUST support the
+traversal of hairpinned ICMP Query sessions.
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+All NAT devices
+(i.e., Basic NAT as well as NAPT devices) MUST support the
+traversal of hairpinned ICMP Error messages:
+'''
+
+[[spec]]
+level = "MUST"
+quote = '''
+a) When forwarding a hairpinned ICMP Error message, the NAT
+device MUST translate the destination IP address of the
+outer IP header to be same as the source IP address of the
+embedded IP packet after the translation.
+'''
+