Subject: RE: [NSIS] NATFW Issue 60: Signaling for ICMP policy rules

From: <[email-masked]>
Date: Mon, 6 Mar 2006 13:34:01 +0200

This looks good to me.

John 

>-----Original Message-----
>From: ext Martin Stiemerling [mailto:[email-masked]] 
>Sent: 24 February, 2006 11:55
>To: nsis
>Subject: [NSIS] NATFW Issue 60: Signaling for ICMP policy rules
>
>Hi all,
>
>We have had the discussions about adding ICMP policy rules to 
>the NATFW NSLP. A short summary of the topic:
>
>3GPP2 requested a feature to signal for ICMP policy rules, 
>i.e., a NATFW node should be able to block a certain type of 
>ICMP traffic, but not meaning ICMP traffic bound to an already 
>configured flow (for instance, ICMP messages related to a TCP session).
>
>Elwyn propose this object to carry ICMP information within the NATFW
>NSLP:
>
>4.2.10  ICMP Types Object
>
>    The 'ICMP types' object contains additional information needed to
>    configure a NAT of firewall with rules to control ICMP 
>traffic.  The
>    object contains a number of values of the ICMP Type field 
>for which a
>    filter action should be set up:
>
>       Type:   NATFW_ICMP_TYPES
>
>       Length: Variable = ((Number of Types carried + 1) + 3) DIV 4
>
>
>
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |    Count      |     Type      |      Type     |    ........   |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                       ................                        |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |    ........   |     Type      |           (Padding)           |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>
>
>
>                        Figure 34: ICMP Types Object
>
>    The fields MUST be interpreted according these rules:
>
>       count: 8 bit integer specifying the number of 'Type' entries in
>       the object.
>
>       type: 8 bit field specifying the ICMP Type values to which this
>       rule applies.
>
>       padding: Sufficient 0 bits to pad out the last word so that the
>       total size of object is an even multiple of words.  Ignored on
>       reception.
>
>_______________________________________________
>nsis mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/nsis
>

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Martin Stiemerling <[email-masked]>
Date: Tue, 7 Mar 2006 15:38:32 +0100

> This looks good to me.

Great. It has been added to the draft which is going to show up on  
the I-D announce list within the next days.
It is now in Section 4.2.10  "ICMP Types Object".

   Martin