Subject: Re: [BEHAVE] Translating ICMPv4 error messages

From: Simon Perreault <[email-masked]>
Date: Fri, 01 Jan 2010 08:03:51 -0500

On 12/31/2009 03:54 PM, Dave Thaler wrote:
> Assuming so, there's one case that deserves special mention: 
> if you get an ICMPv4 error that embeds an ICMPv4 error that 
> embeds an ICMPv4 error that... (etc until MTU is reached),

Same for ICMPv6. It's actually more likely on ICMPv6 because RFC 768
makes the ICMPv4 error payload stop at 64 bits, which prevents
recursion, whereas RFC 4443 has no such limit for ICMPv6. But what
implementations do is another matter, so you have to be ready for both
cases.

> do you have to keep traversing the entire packet and do all 
> the translations?  I would hope not,

A large part of the implementation complexity resides in this recursive
translation feature. I don't know if it is worth the trouble.

What do you suggest we do when we receive such a packet?

Simon
-- 
DNS64 open-source   --> http://ecdysis.viagenie.ca
STUN/TURN server    --> http://numb.viagenie.ca
vCard 4.0           --> http://www.vcarddav.org

---

From: Dave Thaler <[email-masked]>
Date: Fri, 1 Jan 2010 18:22:01 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Simon Perreault
> Sent: Friday, January 01, 2010 5:04 AM
> To: [email-masked]
> Subject: Re: [BEHAVE] Translating ICMPv4 error messages
> 

I'm open to suggestions, but since you're not supposed to send an 
ICMP error in response to an ICMP error, I think this shouldn't 
happen except if someone is trying to be malicious.  So I'd probably
stop at 1 embedded transport header.

-Dave

---

From: marcelo bagnulo braun <[email-masked]>
Date: Tue, 19 Jan 2010 14:54:09 +0100

Simon Perreault escribió:
> On 01/01/2010 01:22 PM, Dave Thaler wrote:
>   
> And drop the packet if it contains more, or send it off partially
> translated?
>
> I'd be happy with dropping it.
>   

I have added the follwoing text to the nat64 draft

         <t>If the incoming IP packet contains a complete (un-fragmented)
         ICMP error message containing a ICMP error message, then the 
packet is silently discarded.</t>

Regards, marcelo