Re: I-D.ietf-v6ops-cpe-simple-security-09

Re: I-D.ietf-v6ops-cpe-simple-security-09 - ICMP Error Messages

james woodyatt <jhw@apple.com> Thu, 11 March 2010 20:34 UTC

Subject: Re: I-D.ietf-v6ops-cpe-simple-security-09 - ICMP Error Messages
Mime-Version: 1.0 (Apple Message framework v1077)
Content-Type: text/plain; charset="iso-8859-1"
From: james woodyatt <jhw@apple.com>
In-Reply-To: <E4D58FF5-3728-46CD-9E20-F28EADC4D174@free.fr>
Date: Thu, 11 Mar 2010 12:17:25 -0800
Cc: IPv6 Operations <v6ops@ops.ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <D5EAA555-09C2-4583-9F4C-02DB882A3CCA@apple.com>
References: <D6F5ACD2-EB43-477E-9F48-AC3EDB3F7EB4@apple.com> <E4D58FF5-3728-46CD-9E20-F28EADC4D174@free.fr>
To: Rémi Després <remi.despres@free.fr>
Sender: owner-v6ops@ops.ietf.org
Precedence: bulk

On Mar 8, 2010, at 00:22, Rémi Després wrote:
> 
> In the draft, the only REC-n concerning ICMP is so far:
> "REC-16: If a gateway forwards a UDP exchange, it MUST also forward ICMP Destination Unreachable messages containing UDP headers that match the exchange state record."
> 
> In my understanding, what is needed is, for each of the transport protocols:
> "REC-n: If a gateway forwards a NNN exchange, it MUST also forward, in both directions, ICMP Error messages containing UDP headers that match the exchange state record."

Please also see REC-29, REC-34 and REC-38.

> - Forwarded error messages must be also for TCP, DCCP, etc., and must be more general than just Destination Unreachable: they must include in particular Packet Too Big notifications which are essential for IPv6 path-MTU discovery.

Agreed, but I'm now inclined to remove all four of those recommendations and insert an explicit recommendation into the "Stateless Filters" section that cites RFC 4890 and specifically references section 4.3.1 "Traffic The Must Not Be Dropped".

Does anyone object to that revision?


--
james woodyatt <jhw@apple.com>
member of technical staff, communications engineering

I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 Ole Troan
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
RE: I-D.ietf-v6ops-cpe-simple-security-09 STARK, BARBARA H (ATTLABS)
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Fwd: I-D.ietf-v6ops-cpe-simple-security-09 - ICMP… Rémi Després
Re: I-D.ietf-v6ops-cpe-simple-security-09 - ICMP … james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 - ICMP … Rémi Després
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 Shane Amante
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Cameron Byrne
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Gert Doering
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Status of RFC 4864 (was Re: I-D.ietf-v6ops-cpe-si… Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Ole Troan
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter