Re: [BEHAVE] [v6ops] protocols without need for ALG ?

On 31 July 2015 at 23:21, Joe Touch <touch@isi.edu> wrote:
> TFTP servers are typically reached at UDP port 69.
>
> It does not use ports or addresses in-band and thus should not need an ALG.

Hmm, to my mind, an "ALG" is necessary if something about the protocol
needs to be understood e.g., look for/change in-band ports or
addresses, and possibly set up corresponding state or temporary access
list/firewall permissions for related traffic.

In the case of TFTP, it is the "TID"s:

"The transfer identifiers (TID's) used by
   TFTP are passed to the Datagram layer to be used as ports; therefore
   they must be between 0 and 65,535.  The initialization of TID's is
   discussed in the section on initial connection protocol."

" A
   requesting host chooses its source TID as described above, and sends
   its initial request to the known TID 69 decimal (105 octal) on the
   serving host.  The response to the request, under normal operation,
   uses a TID chosen by the server as its source TID and the TID chosen
   for the previous message by the requestor as its destination TID.
   The two chosen TID's are then used for the remainder of the transfer."

I think a server could choose to continue to use 69 as its TID for the
full transfer, however in my case it didn't. I still remember it today
because I was only able to get around the unpredictable TID selection
on both ends by using just host IP addresses, which had some risks
because it was a very coarse way of selecting "interesting"
dial-on-demand traffic to hold the link up.

So if in Toerless's scenario it is stateless 1:1 translation between
IPv4 and IPv6, then I don't think an ALG would be necessary for TFTP.
However, if the translation is stateful because translation between
IPv4 and IPv6 isn't 1:1, then I think an ALG is necessary to set up a
mapping of some form.

Regards,
Mark.

>
> Joe
>
> On Jul 31, 2015, at 12:23 AM, Heatley, Nick <nick.heatley@ee.co.uk> wrote:
>
> Same for me.
>
>
>
> From: v6ops [mailto:v6ops-bounces@ietf.org] On Behalf Of Mark Smith
> Sent: 31 July 2015 06:40
> To: Mikael Abrahamsson
> Cc: v6ops list; behave@ietf.org
> Subject: Re: [v6ops] protocols without need for ALG ?
>
>
>
>
> On 31 Jul 2015 3:11 pm, "Mikael Abrahamsson" <swmike@swm.pp.se> wrote:
>>
>> On Thu, 30 Jul 2015, Owen DeLong wrote:
>>
>>>>   SSH/SCP - OK
>>>>   syslog  - OK
>>>>   TFTP    - OK ?
>>>
>>>
>>> Should be OK, depending on which side is client. (client has to be the
>>> private address/translated side of the connection).
>>
>>
>> There are ALGs for TFTP from multiple vendors, and I seem to remember I
>> had problem performing TFTP download from behind a NAT, but I could be
>> mistaken. This should be investigated further.
>>
>
> I'm pretty sure you'd need an ALG for TFTP over NAT, as the file transfer
> itself takes place over unspecified and unpredictable ports. This caused me
> some grief in the past when trying to have a TFTP file transfer hold up a
> dial on demand link.
>
> Regards,
> Mark.
>
>> --
>> Mikael Abrahamsson    email: swmike@swm.pp.se
>>
>>
>> _______________________________________________
>> v6ops mailing list
>> v6ops@ietf.org
>> https://www.ietf.org/mailman/listinfo/v6ops
>
> NOTICE AND DISCLAIMER
> This e-mail (including any attachments) is intended for the above-named
> person(s).  If you are not the intended recipient, notify the sender
> immediately, delete this email from your system and do not disclose or use
> for any purpose.
>
> We may monitor all incoming and outgoing emails in line with current
> legislation. We have taken steps to ensure that this email and attachments
> are free from any virus, but it remains your responsibility to ensure that
> viruses do not adversely affect you.
>
> EE Limited
> Registered in England and Wales
> Company Registered Number: 02382161
> Registered Office Address: Trident Place, Mosquito Way, Hatfield,
> Hertfordshire, AL10 9BW
>
>
>
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops