Re: Route Information Options in Redirect Messages (updated)

[james woodyatt <[e-mail]>]

Hi Jinmei,

I’m writing here to concur explicitly with everything Fred wrote in a his recent reply to this, and also to add my response to this particular point.

On Feb 3, 2017, at 11:51, 神明達哉 <[e-mail]> wrote:
> 
>>> 
>>> - Section 6
>>> 
>>>   "IPv6 Router Advertisement Guard" [RFC6105] ("RA Guard") describes a
>>>   layer-2 filtering technique intended for network operators to use in
>>>   [...]
>>> 
>>>  I don't understand the purpose of this paragraph, especially in the
>>>  context of the Security Considerations section.  Does this sentence
>>>  try to say that we could use the proposed extension in an
>>>  environment where a legitimate router can't send an RA due to
>>>  (perhaps misconfigured) RA guard?  That's probably true, but in that
>>>  case we should solve this problem operationally, i.e., fix the
>>>  configuration of RA guard rather than tweaking the protocol.  And
>>>  that doesn't seem to be a topic of security considerations anyway.
>>>  Or does this paragraph try to say something else?  In that case I
>>>  totally misunderstand it, and I guess it will have to be fully
>>>  rewritten unless I'm the only dumb person to understand it...
>> 
>> An earlier comment on the list asked us to investigate interactions with
>> RFC6105 under Security Considerations. We have analyzed the potential
>> interactions and documented them here to the best of our understanding.
>> But, we would be happy to consider any text change suggestions.
> 
> I can't suggest anything at this moment as I don't understand what it
> actually tries to state...for example, I don't know whether it tries
> to say "the RA Guard function defined in [RFC6105] does not filter ND
> Redirect messages" is considered an issue to be resolved/mitigated or
> a good effect of this proposal.


The idea I had in mind when I wrote this is that we are leaving aside entirely the question of whether or not RFC 6105 has any issues to be identified after reviewing our draft. It’s our view that this draft is applicable in networks where no RA Guard function is deployed. We include this note in section 6 because we are aware that RFC 6105 exists, and our draft is relevant to the considerations that drive operators to deploy RA Guard functions.


--james woodyatt <[e-mail] <mailto:[e-mail]>>