Re: Shim-header in every re-located packet [Re: Design decisions made at the interim SHIM6 WG meeting]

[Pekka Savola <pekkas@netcore.fi>]

On Fri, 28 Oct 2005, Iljitsch van Beijnum wrote:
> > 1) Specifying such a rule is safe if it's known that the firewall would 
> > only accept packets with a particular header type if there is no proceeding 
> > header.
>
> No header following the one that the firewall is looking at, you mean?
>
> Well, if the firewall doesn't understand the shim header, how would it know 
> whether other headers follow the shim header? (Next header field isn't 
> necessarily in the same place in all headers. The prime example is ESP where 
> it actually follows the "next" header data.)
>
> And if the firewall does understand the shim header, it can obviously 
> interpret the TCP/UDP/other header that follows so there is no reason for the 
> firewall to behave in the way you mentioned.

All the non-final extension headers except fragment header have the 
same TLV format.  At least one firewall implementor has stated to use 
this logic, but I don't know if/how they differentiate "extension 
headers" and arbitrary data packets.

Even though this case was considered marginal enough we should 
evaluate whether requiring the use of an extension header is expected 
to be useful enough.

--
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings