[v6ops] RFC 6092 [was draft-ietf-v6ops-balanced-ipv6-security WGLC]

[Brian E Carpenter <[e-mail]>]

On 20/11/2013 22:37, Marc Lampo wrote:
> Yes, RFC 6092 recommends that unsolicited packets be dropped by default !
> 
>   REC-34  By DEFAULT, a gateway MUST respond with an ICMPv6
>            "Destination Unreachable" error code 1 (Communication with
>            destination administratively prohibited), to any unsolicited
>            inbound SYN packet after waiting at least 6 seconds without
>            first forwarding the associated outbound SYN or SYN/ACK from
>            the interior peer.

Er, no, it recommends that unacknowledged unsolicited SYNs should cause
Destination Unreachable, if no TCP listener has responded after 6 seconds.
The gateway isn't dropping anything. It is required to be stateful for
6 seconds in case there is a response.

> "transparent mode" "MAY" be the default (which, in the context, I interpret
> as a kind of "second choice")

That interpretation is not justified by RFC 2119.

> 
>    REC-49  Internet gateways with IPv6 simple security capabilities MUST
>            provide an easily selected configuration option that permits
>            a "transparent mode" of operation that forwards all
>            unsolicited flows regardless of forwarding direction, i.e.,
>            not to use the IPv6 simple security capabilities of the
>            gateway.  The transparent mode of operation MAY be the
>            default configuration.

   Brian