Subject: [NSIS] NATFW Issue 60: Signaling for ICMP policy rules

From: Martin Stiemerling <[email-masked]>
Date: Fri, 24 Feb 2006 10:55:22 +0100

Hi all,

We have had the discussions about adding ICMP policy rules to the  
NATFW NSLP. A short summary of the topic:

3GPP2 requested a feature to signal for ICMP policy rules, i.e., a  
NATFW node should be able to block a certain type of ICMP traffic,  
but not meaning ICMP traffic bound to an already configured flow (for  
instance, ICMP messages related to a TCP session).

Elwyn propose this object to carry ICMP information within the NATFW  
NSLP:

4.2.10  ICMP Types Object

    The 'ICMP types' object contains additional information needed to
    configure a NAT of firewall with rules to control ICMP traffic.  The
    object contains a number of values of the ICMP Type field for  
which a
    filter action should be set up:

       Type:   NATFW_ICMP_TYPES

       Length: Variable = ((Number of Types carried + 1) + 3) DIV 4

      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |    Count      |     Type      |      Type     |    ........   |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                       ................                        |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |    ........   |     Type      |           (Padding)           |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                        Figure 34: ICMP Types Object

    The fields MUST be interpreted according these rules:

       count: 8 bit integer specifying the number of 'Type' entries in
       the object.

       type: 8 bit field specifying the ICMP Type values to which this
       rule applies.

       padding: Sufficient 0 bits to pad out the last word so that the
       total size of object is an even multiple of words.  Ignored on
       reception.

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis