Re: Comments on multi6dt documents

[Pekka Savola <pekkas@netcore.fi>]

Following up on an old message, sorry...

On Thu, 11 Nov 2004, Erik Nordmark wrote:
> > Agreed.  I wasn't sure of the context, just that IP+EXT+whatever might not 
> > do it.  Destination options however provide the facilities today for 
> > skipping over them without making assumptions; this might not in practice 
> > be any better though.
>
> If a firewall is built on the philosophy to be conservative it will not
> let anything new through, whether it is a new payload type, a new
> option, or whatever.

True .. but firewalls of today don't even have a _chance_ of skipping 
over the extension header, even if they, or their administrators would 
want that (well, if the extension header is in TLV format, maybe then, 
because some firewalls assume the next ext headers are in TLV). 
Destination options at least allow that possibility.

> > So, the demux code needs to deal with ICMPv6 address translation. What 
> > about other protocols?  Do we want to care for the others which might be 
> > doing similar things, or we just say 'just do the referral thing'?
>
> What other protocols do you have in mind?
[...]

Right out, I can't think of anything else than ICMP and multicast 
(which you already mentioned), but that doesn't of course mean those 
kind of protocols might not exist.  Therefore I think it would make 
sense to put this sufficiently clearly in the document that people 
need to keep in mind that there may be some protocols which might call 
for special handling.

> > The fact this is an ALG in a sense should possibly be stated, with the 
> > caveat that we're assuming that there aren't other equally "fundamental" 
> > protocols where you shouldn't be required deal with the full referral 
> > process.
>
> Why do you wish to confuse things by calling it an ALG? It is a local matter 
> for the implementation how it demuxes ICMP errors. ALGs and NATs make people 
> think of middleboxes which perform transformations which can not be reversed.

Sorry, I was just trying to figure out a term which says, "requires 
the host's shim layer and possibly some weirder middleboxes (like 
stateful firewalls, when they want to figure whether to pass this 
error in or not) have knowledge of applications' semantics [and if 
there are new such applications, requiring that this application 
knowledge to be updated], to be able to mangle the addresses inside 
the payload correctly."

--
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings