Re: raw thoughts on v6 firewalls

[Jun-ichiro itojun Hagino <itojun@iijlab.net>]

>I don't think v6 firewalls can be killed.  They're a mechanism to ensure 
>some form of security policy; trusting end nodes to do the right thing is 
>not enough.
>
>But there are problems with v6 firewalling.  I've been trying to get
>around to writing a draft for a year or so now but never did it (further
>than the baseline summary of the content): perhaps now it's a better time.

	i understand we can't kill firewall.  they need to be more flexible -
	like allowing inbound connection for p2p protocols and such.  but then,
	we may be opening a big can of worms...

>One potentially major deployment issue is how the firewall is supposed to
>handle packets where extension header contains a header it does not not
>recognize and thus cannot parse e.g. UDP/TCP headers.

	i'm trying to implement IPv6 stateful inspection into OpenBSD PF,
	but having no time to do so...

itojun