RE: IPv6-PMP?

[Christian Huitema <huitema@windows.microsoft.com>]

> For the record, I've not received any off-list messages to explain
> how the IETF managed to arrive at a consensus about the need for
> stateful IPv6 packet filters in default gateways while deferring
> efforts to define a standard method for nodes to solicit pinholes
> through them.

I don't think there ever was an IETF recommendation about this. What happened is more a recognition that the "no firewall -- no problem" approach won't be accepted in practice. While modern PC's and MAC's ship with a OS firewall, there are many other devices on home networks. These other devices often make the hypothesis that the home network is safe, and expect to be "protected". The vendors of gateway devices don't believe they can market a "no firewall" solution.

Apple's PMP effort tries to solve the same problem that Microsoft addressed with the UPNP profile for gateway devices in 2001. The main difference between the two approaches is the use of an XML framework in UPNP, versus short binary messages in PMP. Both designs seem to have the same security model, i.e. none besides verifying that the host is actually inside the home network. Rémi Denis-Courmont mentioned the alleged brokenness of the UPNP design, but in fact the main criticism against the UPNP solution is this security model, shared by Apple's PMP.

In any case, the BEHAVE working group is chartered to deal with this issue, and would be a better place for the discussion.

-- Christian Huitema