Re: [v6ops] Last Call: <draft-ietf-v6ops-ra-guard-implementation-04.txt> (Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard)) to Best Current Practice

On 5/30/12 12:32 , Ronald Bonica wrote:
> Joel,
> 
> On the one hand, I don't think that v6ops is overstepping its
> charter. It isn't modifying IPv6. It is merely identifying a
> combination of IPv6 features that might spell trouble used in the
> same datagram.

It's saying that that packets matching the criterion should be discarded
in order to protect yourself from damage. That is to my mind a fairly
operational recommendation.

> On the other hand, I would be thrilled if the 6man WG would update
> RFC 4443 to say something like "ICMPv6 packets MUST NOT be fragmented
> unless the ICMPv6 Type, Code and Checksum all fit in the first
> fragment".

+1

> Ron <Speaking as individual contributor>
> 
> 
>> -----Original Message----- From: v6ops-bounces@ietf.org
>> [mailto:v6ops-bounces@ietf.org] On Behalf Of Joel M. Halpern Sent:
>> Wednesday, May 30, 2012 12:41 PM To: 'Fernando Gont' Cc:
>> v6ops@ietf.org Subject: Re: [v6ops] Last Call:
>> <draft-ietf-v6ops-ra-guard- implementation-04.txt> (Implementation
>> Advice for IPv6 Router Advertisement Guard (RA-Guard)) to Best
>> Current Practice
>> 
>> I do see the importance of being apply to apply RAGuard in a
>> device which does not accumulate fragment state.  (I don't want to
>> try to analyze the potential DoS attack of having such state.)
>> 
>> However, the proposal introduces a network limtiation, essentially
>> a protocol change, in the network.  I did not think v6Ops was free
>> to recommend behaviors (dropping unclassifiable fragments) which
>> basically violate the base IPv6 spec.
>> 
>> It seems that the right answer was discussed much earlier, namely 
>> changing the protocol behavior (a 6man activity) to tell hosts to 
>> reject RA and ND packets which were received in fragments.
>> 
>> If that is the right answer, then we have to be very careful about 
>> creating long-lived restrictions as a remediation until such a
>> solution can be adopted.
>> 
>> Yours, Joel _______________________________________________ v6ops
>> mailing list v6ops@ietf.org 
>> https://www.ietf.org/mailman/listinfo/v6ops
> _______________________________________________ v6ops mailing list 
> v6ops@ietf.org https://www.ietf.org/mailman/listinfo/v6ops
> 