Re: [v6ops] RFC 6092 [was draft-ietf-v6ops-balanced-ipv6-security WGLC]

[Marc Lampo <[e-mail]>]

A pity that the text can be interpreted in various ways and that those lead
to completely opposite results.

(written by a politician ? ;-)


On Wed, Nov 20, 2013 at 8:42 PM, Brian E Carpenter <
[e-mail]> wrote:

> On 20/11/2013 22:37, Marc Lampo wrote:
> > Yes, RFC 6092 recommends that unsolicited packets be dropped by default !
> >
> >   REC-34  By DEFAULT, a gateway MUST respond with an ICMPv6
> >            "Destination Unreachable" error code 1 (Communication with
> >            destination administratively prohibited), to any unsolicited
> >            inbound SYN packet after waiting at least 6 seconds without
> >            first forwarding the associated outbound SYN or SYN/ACK from
> >            the interior peer.
>
> Er, no, it recommends that unacknowledged unsolicited SYNs should cause
> Destination Unreachable, if no TCP listener has responded after 6 seconds.
> The gateway isn't dropping anything. It is required to be stateful for
> 6 seconds in case there is a response.
>
> > "transparent mode" "MAY" be the default (which, in the context, I
> interpret
> > as a kind of "second choice")
>
> That interpretation is not justified by RFC 2119.
>
> >
> >    REC-49  Internet gateways with IPv6 simple security capabilities MUST
> >            provide an easily selected configuration option that permits
> >            a "transparent mode" of operation that forwards all
> >            unsolicited flows regardless of forwarding direction, i.e.,
> >            not to use the IPv6 simple security capabilities of the
> >            gateway.  The transparent mode of operation MAY be the
> >            default configuration.
>
>    Brian
>
>