Re: [v6ops] [Technical Errata Reported] RFC4890 (3985)

[Elwyn Davies <[e-mail]>]

Thanks,
Elwyn

On Mon, 2014-05-19 at 07:34 -0700, joel jaeggli wrote:
> On 5/18/14, 2:05 PM, Fred Baker (fred) wrote:
> > I gather the erratum should be accepted. Apparently that’s your todo, Joel.
> 
> Set as verified.
> 
> Thank you.
> joel
> 
> > On May 13, 2014, at 5:07 PM, RFC Errata System <[e-mail]> wrote:
> > 
> >> The following errata report has been submitted for RFC4890,
> >> "Recommendations for Filtering ICMPv6 Messages in Firewalls".
> >>
> >> --------------------------------------
> >> You may review the report below and at:
> >> http://www.rfc-editor.org/errata_search.php?rfc=4890&eid=3985
> >>
> >> --------------------------------------
> >> Type: Technical
> >> Reported by: James Robertson <[e-mail]>
> >>
> >> Section: Appendix B
> >>
> >> Original Text
> >> -------------
> >> if [ "$STATE_ENABLED" -eq "1" ]
> >> then
> >>  # Allow incoming time exceeded code 0 messages
> >>  # only for existing sessions
> >>  for inner_prefix in $INNER_PREFIXES
> >>  do
> >>    ip6tables -A icmpv6-filter -m state -p icmpv6 \
> >>         -d $inner_prefix \
> >>         --state ESTABLISHED,RELATED --icmpv6-type packet-too-big \
> >>         -j ACCEPT
> >>  done
> >> else
> >>  # Allow incoming time exceeded code 0 messages
> >>  for inner_prefix in $INNER_PREFIXES
> >>  do
> >>    ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \
> >>         --icmpv6-type ttl-zero-during-transit -j ACCEPT
> >>  done
> >> fi
> >>
> >> Corrected Text
> >> --------------
> >> if [ "$STATE_ENABLED" -eq "1" ]
> >> then
> >>  # Allow incoming time exceeded code 0 messages
> >>  # only for existing sessions
> >>  for inner_prefix in $INNER_PREFIXES
> >>  do
> >>    ip6tables -A icmpv6-filter -m state -p icmpv6 \
> >>     -d $inner_prefix \
> >>     --state ESTABLISHED,RELATED --icmpv6-type ttl-zero-during-transit \
> >>     -j ACCEPT
> >>  done
> >> else
> >>  # Allow incoming time exceeded code 0 messages
> >>  for inner_prefix in $INNER_PREFIXES
> >>  do
> >>    ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \
> >>         --icmpv6-type ttl-zero-during-transit -j ACCEPT
> >>  done
> >> fi
> >>
> >> Notes
> >> -----
> >> RFC 4890 Errata ID 2706 states that icmpv6-type packet-too-big should
> >> state icmpv6-type ttl-zero-during-transmit. This should read
> >> ttl-zero-during-transit.
> >>
> >> Instructions:
> >> -------------
> >> This errata is currently posted as "Reported". If necessary, please
> >> use "Reply All" to discuss whether it should be verified or
> >> rejected. When a decision is reached, the verifying party (IESG)
> >> can log in to change the status and edit the report, if necessary. 
> >>
> >> --------------------------------------
> >> RFC4890 (draft-ietf-v6ops-icmpv6-filtering-recs-03)
> >> --------------------------------------
> >> Title               : Recommendations for Filtering ICMPv6 Messages in Firewalls
> >> Publication Date    : May 2007
> >> Author(s)           : E. Davies, J. Mohacsi
> >> Category            : INFORMATIONAL
> >> Source              : IPv6 Operations
> >> Area                : Operations and Management
> >> Stream              : IETF
> >> Verifying Party     : IESG
> > 
> 
>