Re: [v6ops] Revised I-D: Advice on RA-Guard Implementation

[Fernando Gont <[e-mail]>]

Hi, Simon,

Thanks so much for your feedback! Please find my comments in-line...

On 01/05/2012 10:50 AM, Simon Perreault wrote:
> Fernando Gont wrote, on 01/04/2012 07:58 PM:
>> We've published the IETF I-D "Implementation Advice for IPv6 Router
>> Advertisement Guard (RA-Guard)". It is available at:
>> <http://www.ietf.org/id/draft-gont-v6ops-ra-guard-implementation-00.txt>
> 
> Section 3 (implementation advice) does not explicitly mention fragment handling.
> Is this intentional? Does the advice implicitly apply to fragments? Some
> clarification is needed IMHO.

The second bullet in Section 3 is meant to address fragment-handling:

   o  If the layer-2 device is unable to identify whether the packet is
      an ICMPv6 Router Advertisement message or not (i.e., the packet is
      a fragment, and the necessary information is missing), and the
      IPv6 Source Address of the packet is a link-local address or the
      unspecified address (::), block the packet.

The idea is that if that non-first fragments are always forwarded,
whereas first-fragments are blocked if:

a) We've found that what follows the fragment header is an RA packet, or,

b) this is a first-fragment, and it is missing upper-layer protocol
information.


Please let me know if you still feel that further clarification is
needed. And, if so, whether you feel that an additional bullet should be
added, or whether the aforementioned clarification should be added right
after the bullets (i.e., non-bulleted).

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492