Re: [v6ops] [Technical Errata Reported] RFC4890 (3985)

[joel jaeggli <[e-mail]>]

On 5/14/14, 8:25 PM, Fred Baker (fred) wrote:
> Guys:
> 
> Do we agree with this?

it's not really normative text, it's an example in an appendix.

assuming you think it's an issue  and the correction is reasonable I
would probably just hold it for a document update (seems unlikely atm
but who knows)


> On May 13, 2014, at 5:07 PM, RFC Errata System <[e-mail]> wrote:
> 
>> The following errata report has been submitted for RFC4890,
>> "Recommendations for Filtering ICMPv6 Messages in Firewalls".
>>
>> --------------------------------------
>> You may review the report below and at:
>> http://www.rfc-editor.org/errata_search.php?rfc=4890&eid=3985
>>
>> --------------------------------------
>> Type: Technical
>> Reported by: James Robertson <[e-mail]>
>>
>> Section: Appendix B
>>
>> Original Text
>> -------------
>> if [ "$STATE_ENABLED" -eq "1" ]
>> then
>>  # Allow incoming time exceeded code 0 messages
>>  # only for existing sessions
>>  for inner_prefix in $INNER_PREFIXES
>>  do
>>    ip6tables -A icmpv6-filter -m state -p icmpv6 \
>>         -d $inner_prefix \
>>         --state ESTABLISHED,RELATED --icmpv6-type packet-too-big \
>>         -j ACCEPT
>>  done
>> else
>>  # Allow incoming time exceeded code 0 messages
>>  for inner_prefix in $INNER_PREFIXES
>>  do
>>    ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \
>>         --icmpv6-type ttl-zero-during-transit -j ACCEPT
>>  done
>> fi
>>
>> Corrected Text
>> --------------
>> if [ "$STATE_ENABLED" -eq "1" ]
>> then
>>  # Allow incoming time exceeded code 0 messages
>>  # only for existing sessions
>>  for inner_prefix in $INNER_PREFIXES
>>  do
>>    ip6tables -A icmpv6-filter -m state -p icmpv6 \
>>     -d $inner_prefix \
>>     --state ESTABLISHED,RELATED --icmpv6-type ttl-zero-during-transit \
>>     -j ACCEPT
>>  done
>> else
>>  # Allow incoming time exceeded code 0 messages
>>  for inner_prefix in $INNER_PREFIXES
>>  do
>>    ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \
>>         --icmpv6-type ttl-zero-during-transit -j ACCEPT
>>  done
>> fi
>>
>> Notes
>> -----
>> RFC 4890 Errata ID 2706 states that icmpv6-type packet-too-big should
>> state icmpv6-type ttl-zero-during-transmit. This should read
>> ttl-zero-during-transit.
>>
>> Instructions:
>> -------------
>> This errata is currently posted as "Reported". If necessary, please
>> use "Reply All" to discuss whether it should be verified or
>> rejected. When a decision is reached, the verifying party (IESG)
>> can log in to change the status and edit the report, if necessary. 
>>
>> --------------------------------------
>> RFC4890 (draft-ietf-v6ops-icmpv6-filtering-recs-03)
>> --------------------------------------
>> Title               : Recommendations for Filtering ICMPv6 Messages in Firewalls
>> Publication Date    : May 2007
>> Author(s)           : E. Davies, J. Mohacsi
>> Category            : INFORMATIONAL
>> Source              : IPv6 Operations
>> Area                : Operations and Management
>> Stream              : IETF
>> Verifying Party     : IESG
>