RE: Route Information Options in Redirect Messages (updated)

Hi Jinmei-san,

One important clarification below:

> -----Original Message-----
> From: ipv6 [mailto:ipv6-bounces@ietf.org] On Behalf Of ????
> Sent: Tuesday, February 07, 2017 10:18 AM
> To: james woodyatt <jhw@google.com>
> Cc: IPv6 List <ipv6@ietf.org>
> Subject: Re: Route Information Options in Redirect Messages (updated)
> 
> At Mon, 6 Feb 2017 12:07:32 -0800,
> james woodyatt <jhw@google.com> wrote:
> 
> > >>>   "IPv6 Router Advertisement Guard" [RFC6105] ("RA Guard") describes a
> > >>>   layer-2 filtering technique intended for network operators to use in
> > >>>   [...]
> > >>>
> > >>>  I don't understand the purpose of this paragraph,[...]
> 
> > The idea I had in mind when I wrote this is that we are leaving
> > aside entirely the question of whether or not RFC 6105 has any
> > issues to be identified after reviewing our draft. It’s our view
> > that this draft is applicable in networks where no RA Guard function
> > is deployed. We include this note in section 6 because we are aware
> > that RFC 6105 exists, and our draft is relevant to the
> > considerations that drive operators to deploy RA Guard functions.
> 
> Hmm, maybe I'm so dumb but I'm afraid I still don't understand intent
> clearly.  Do you mean an operational assumption of this proposal is to
> use it in a link where RA guard isn't deployed?  If so, it's far
> better (at least to me) to just say so.
> 
> BTW, if this proposal keeps the concept of "unsolicited redirect" and
> also allows the destination address of '::' to bypass the host's
> validity check of whether it's really the first hop router for the
> destination,

No, that is not what we want to have happen. The document doesn't
say this currently, but we want to retain a revised version of the validity
check. The revised version of the check would say:

OLD:
      - The IP source address of the Redirect is the same as the current
        first-hop router for the specified ICMP Destination Address.

NEW:
      - The IP source address of the Redirect is the same as the current
        first-hop router for the specified ICMP Destination Address, or
        (when the ICMP Destination Address is '::') the same as the current
        first-hop router for the specified RIOs

Would welcome better wording than this, but we definitely do want
to retain the validity check. Comments?

Thanks - Fred
fred.l.templin@boeing.com

> then I'd rather be more interested in a discussion of
> whether we should extend RFC6105 so it will also cover redirects and
> filter out "rogue redirects".  That's because such an unsolicited
> redirect is quite powerful and allows almost any arbitrary on-link
> attacker to exploit it at almost the same level of rogue RAs.  Aside
> from specific conclusion from the discussion, a discussion like that
> would look good content to me for the security considerations section
> of this document.
> 
> --
> JINMEI, Tatuya
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------