Re: [v6ops] A common problem with SLAAC in "renumbering" scenarios

[j h woodyatt <[e-mail]>]

On Feb 20, 2019, at 17:13, Fernando Gont <[e-mail]> wrote:
> 
> Given that RFC6092 recommends "only allow outgoing connections”...

I certainly don’t remember writing that, and I just double-checked the text, and I’m pretty sure that recommendation is not in RFC 6092. The relevant portion is Section 3.4 Passive Listeners, I think, and it only goes so far as to say this:

   REC-49: Internet gateways with IPv6 simple security capabilities MUST
   provide an easily selected configuration option that permits a
   "transparent mode" of operation that forwards all unsolicited flows
   regardless of forwarding direction, i.e., not to use the IPv6 simple
   security capabilities of the gateway.  The transparent mode of
   operation MAY be the default configuration.

The recommendation to deny inbound flows to passive listeners by default, I believe, comes from RFC 4864, which says this on page 15:

   These should provide a default configuration where incoming traffic
   is limited to return traffic resulting from outgoing packets
   (sometimes known as reflective session state).

The reason this is important: RFC 6092 includes all that special requirements language despite being Informational category because IPv6 Ready and various other groups were asking for guidance by which they could write their own standards for IPv6 Simple Security requirements, and IETF wanted to give them that guidance. And so, RFC 6092 was written with that aim in mind. RFC 4864 is just an Informational document that offers some opinionated assertions on the topic, and I would say it’s worth what you paid for it.

As far as I know, IETF has not yet actually written a Standards Track RFC that says Internet gateways SHOULD (note well: requirements language) block inbound flows to passive listeners. I’d be interested to know if I’ve missed that news. In any case, my recollection is that it wasn’t the case when RFC 6092 was published.

Shorter james: don’t blame me for this. I didn’t do it.

--james woodyatt <[e-mail]>