Re: Route Information Options in Redirect Messages (updated)

[神明達哉 <[e-mail]>]

At Mon, 6 Feb 2017 12:07:32 -0800,
james woodyatt <[e-mail]> wrote:

> >>>   "IPv6 Router Advertisement Guard" [RFC6105] ("RA Guard") describes a
> >>>   layer-2 filtering technique intended for network operators to use in
> >>>   [...]
> >>>
> >>>  I don't understand the purpose of this paragraph,[...]

> The idea I had in mind when I wrote this is that we are leaving
> aside entirely the question of whether or not RFC 6105 has any
> issues to be identified after reviewing our draft. It’s our view
> that this draft is applicable in networks where no RA Guard function
> is deployed. We include this note in section 6 because we are aware
> that RFC 6105 exists, and our draft is relevant to the
> considerations that drive operators to deploy RA Guard functions.

Hmm, maybe I'm so dumb but I'm afraid I still don't understand intent
clearly.  Do you mean an operational assumption of this proposal is to
use it in a link where RA guard isn't deployed?  If so, it's far
better (at least to me) to just say so.

BTW, if this proposal keeps the concept of "unsolicited redirect" and
also allows the destination address of '::' to bypass the host's
validity check of whether it's really the first hop router for the
destination, then I'd rather be more interested in a discussion of
whether we should extend RFC6105 so it will also cover redirects and
filter out "rogue redirects".  That's because such an unsolicited
redirect is quite powerful and allows almost any arbitrary on-link
attacker to exploit it at almost the same level of rogue RAs.  Aside
from specific conclusion from the discussion, a discussion like that
would look good content to me for the security considerations section
of this document.

--
JINMEI, Tatuya