Re: [v6ops] [Technical Errata Reported] RFC4890 (3985)

[Suresh Krishnan <[e-mail]>]

Yes. This is a copy paste error on my part. The script probably needs to 
be rewritten to make use of more modern netfilter features like 
conntrack. I am willing to take a shot at a -bis version if Elwyn wants 
to go that way.

Thanks
Suresh

On 05/15/2014 10:44 AM, Fred Baker (fred) wrote:
> Thanks
>
> On May 15, 2014, at 3:24 AM, Elwyn Davies <[e-mail]> wrote:
>
>> HI.
>>
>> This looks correct.  I am forwarding the message to Suresh who actually
>> authored the script for an opinion.
>>
>> Assuming that he concurs, I don't see any harm in issuing an erratum and
>> a very few people might actually be using the script verbatim.
>>
>> There was a move afoot to make a new version (and possibly transition
>> this to BCP) but we haven't managed to get it together to do so yet.
>>
>> Regards,
>> Elwyn
>>
>> On Wed, 2014-05-14 at 21:09 -0700, joel jaeggli wrote:
>>> On 5/14/14, 8:25 PM, Fred Baker (fred) wrote:
>>>> Guys:
>>>>
>>>> Do we agree with this?
>>>
>>> it's not really normative text, it's an example in an appendix.
>>>
>>> assuming you think it's an issue  and the correction is reasonable I
>>> would probably just hold it for a document update (seems unlikely atm
>>> but who knows)
>>>
>>>
>>>> On May 13, 2014, at 5:07 PM, RFC Errata System <[e-mail]> wrote:
>>>>
>>>>> The following errata report has been submitted for RFC4890,
>>>>> "Recommendations for Filtering ICMPv6 Messages in Firewalls".
>>>>>
>>>>> --------------------------------------
>>>>> You may review the report below and at:
>>>>> http://www.rfc-editor.org/errata_search.php?rfc=4890&eid=3985
>>>>>
>>>>> --------------------------------------
>>>>> Type: Technical
>>>>> Reported by: James Robertson <[e-mail]>
>>>>>
>>>>> Section: Appendix B
>>>>>
>>>>> Original Text
>>>>> -------------
>>>>> if [ "$STATE_ENABLED" -eq "1" ]
>>>>> then
>>>>> # Allow incoming time exceeded code 0 messages
>>>>> # only for existing sessions
>>>>> for inner_prefix in $INNER_PREFIXES
>>>>> do
>>>>>    ip6tables -A icmpv6-filter -m state -p icmpv6 \
>>>>>         -d $inner_prefix \
>>>>>         --state ESTABLISHED,RELATED --icmpv6-type packet-too-big \
>>>>>         -j ACCEPT
>>>>> done
>>>>> else
>>>>> # Allow incoming time exceeded code 0 messages
>>>>> for inner_prefix in $INNER_PREFIXES
>>>>> do
>>>>>    ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \
>>>>>         --icmpv6-type ttl-zero-during-transit -j ACCEPT
>>>>> done
>>>>> fi
>>>>>
>>>>> Corrected Text
>>>>> --------------
>>>>> if [ "$STATE_ENABLED" -eq "1" ]
>>>>> then
>>>>> # Allow incoming time exceeded code 0 messages
>>>>> # only for existing sessions
>>>>> for inner_prefix in $INNER_PREFIXES
>>>>> do
>>>>>    ip6tables -A icmpv6-filter -m state -p icmpv6 \
>>>>>     -d $inner_prefix \
>>>>>     --state ESTABLISHED,RELATED --icmpv6-type ttl-zero-during-transit \
>>>>>     -j ACCEPT
>>>>> done
>>>>> else
>>>>> # Allow incoming time exceeded code 0 messages
>>>>> for inner_prefix in $INNER_PREFIXES
>>>>> do
>>>>>    ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \
>>>>>         --icmpv6-type ttl-zero-during-transit -j ACCEPT
>>>>> done
>>>>> fi
>>>>>
>>>>> Notes
>>>>> -----
>>>>> RFC 4890 Errata ID 2706 states that icmpv6-type packet-too-big should
>>>>> state icmpv6-type ttl-zero-during-transmit. This should read
>>>>> ttl-zero-during-transit.
>>>>>
>>>>> Instructions:
>>>>> -------------
>>>>> This errata is currently posted as "Reported". If necessary, please
>>>>> use "Reply All" to discuss whether it should be verified or
>>>>> rejected. When a decision is reached, the verifying party (IESG)
>>>>> can log in to change the status and edit the report, if necessary.
>>>>>
>>>>> --------------------------------------
>>>>> RFC4890 (draft-ietf-v6ops-icmpv6-filtering-recs-03)
>>>>> --------------------------------------
>>>>> Title               : Recommendations for Filtering ICMPv6 Messages in Firewalls
>>>>> Publication Date    : May 2007
>>>>> Author(s)           : E. Davies, J. Mohacsi
>>>>> Category            : INFORMATIONAL
>>>>> Source              : IPv6 Operations
>>>>> Area                : Operations and Management
>>>>> Stream              : IETF
>>>>> Verifying Party     : IESG
>>>>
>>>
>>>
>>
>