RE: I-D Action: draft-ietf-6man-rfc6434-bis-01.txt

["Templin, Fred L" <[e-mail]>]

Hi Lorenzo,

No, my understanding is now lined up with Bob’s guidance as well as
with some off-list guidance I received. It is just an ordinary router, and
whether/not it would do anything special to block potential reflection
attacks is simply a matter of local policy configuration.

It is a security consideration yes, but it is still just an ordinary router.

Thanks - Fred

From: Lorenzo Colitti [mailto:[e-mail]]
Sent: Friday, September 22, 2017 6:41 AM
To: Templin, Fred L <[e-mail]>
Cc: Bob Hinden <[e-mail]>; Russ White <[e-mail]>; IPv6 List <[e-mail]>
Subject: Re: I-D Action: draft-ietf-6man-rfc6434-bis-01.txt

On Thu, Sep 21, 2017 at 3:17 AM, Templin, Fred L <[e-mail]<mailto:[e-mail]>> wrote:
I hear you, and I am not suggesting any change in the host and router
definitions. However, an end system that acts as both a router and a
host has to do something slightly different than an ordinary router
would.

If the end system receives a packet with a destination that does
not match one of its own delegated prefixes, it needs to drop the
packet and send "Destination Unreachable - No route to destination"
instead of forwarding the packet to another node (e.g., to a default
router). This is necessary to avoid a reflection attack where the attacker
attempts to abuse the end system by making it do work to forward
packets it should not be handling.

Wait, what? Where is this documented?