Subject: Re: [BEHAVE] ICE and v4v6NATs

From: Rémi Denis-Courmont <[email-masked]>
Date: Thu, 27 Mar 2008 12:40:43 +0200

Le Wednesday 26 March 2008 20:34:42 ext marcelo bagnulo, vous avez écrit :
> In the v6ops WG we are defining the requirements for next generation v4
> <-> v6 NATs.
> One issue that it is not clear to use (among many), is what level of ICE
> support shoudl be required, or what type of interaction between these
> boxes and ICE should be required.

Quick note: ICE packets are integrity-protected: the only thing a middlebox 
can do with them: IP/port number changes, and/or drop/delay transmission. 
Unless the middlebox is willing to re-do SHA1-hashing _and_ learns the 
hashing material off-band from the "signaling channel", such as the chain of 
SIP proxies.

> The scenario that we are considering is the following one:
>
>  +----------------------------------+-------------------------------+
>  |           v4 Internet            |         v6 Internet           |
>  | +------+                   +------------+               +------+ |
>  | | IPv4 |                   |   NAT64    |               | IPv6 | |
>  | | only |-------------------|  v4 |  v6  |---------------| only | |
>  | | node |                   | Translator |               | node | |
>  | +------+                   +------------+               +------+ |
>  +----------------------------------+-------------------------------+
>
> Now, would it be possible to use ICE in this scenario?

There are two ways:

UNSAFish way: One node obtains an IP/port mapping within the other realm, and 
provides that mapping to the other node, as an ICE candidate.

ALGish way: ICE candidates are translated on the signaling path. Ugly.

-- 
Rémi Denis-Courmont