Re: [secdir] draft-ietf-behave-ftp64

[Iljitsch van Beijnum <[e-mail]>]

I've removed the CC to IESG, I think it's easier to first discuss this a bit more privately.

On 5 jun 2011, at 22:44, Donald Eastlake wrote:

> I have a bit of a problem with the title  ("An FTP ALG for
> IPv6-to-IPv4 translation") and the slant of some of the wording. It
> claims to be able to describe, as an Application Level Gateway,
> various recommendations which are then combined with a separate
> existing IPv6-to-IPv4 ALG. It talks about multiple ALGs being
> implemented at a single entity that are handling an single FTP
> session. This just all seems very odd to me as it isn't very clear
> what the interface between these different ALGs all somehow
> cooperating on one session is.

When you say "separate existing IPv6-to-IPv4 ALG" do you mean the NAT64 translator?

I included a few sentences about other FTP ALGs because I wanted to make the point that if you put multiple types of functionality in one big ALG, the side effect of the AUTH command must still be maintained even if using that command is not allowed by policy by "another ALG".

Do you agree that's useful? I guess I need to describe it better.

> I believe, in reality, anyone
> implementing this will take an existing ALG and modify it as suggested
> in the draft. The draft would therefore make more sense if written as
> suggested changes to a single ALG rather than as an additional ALG
> that is somehow compounded with an existing FTP ALG... Just my
> opinion.

Not sure how that would look in practice, though.

Thanks for the review,

Iljitsch