[v6ops] [Technical Errata Reported] RFC4890 (2706)

RFC Errata System <rfc-editor@rfc-editor.org> Sun, 06 February 2011 13:26 UTC

To: elwynd@dial.pipex.com, mohacsi@niif.hu, dromasca@avaya.com, rbonica@juniper.net, fred.baker@cisco.com, joelja@bogus.com, kurtis@kurtis.pp.se
From: RFC Errata System <rfc-editor@rfc-editor.org>
Message-Id: <20110206132612.9F888E0701@rfc-editor.org>
Date: Sun, 06 Feb 2011 05:26:12 -0800
Cc: phil.whineray@gmail.com, v6ops@ietf.org, rfc-editor@rfc-editor.org
Subject: [v6ops] [Technical Errata Reported] RFC4890 (2706)
Precedence: list

The following errata report has been submitted for RFC4890,
"Recommendations for Filtering ICMPv6 Messages in Firewalls".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=4890&eid=2706

--------------------------------------
Type: Technical
Reported by: Phil Whineray <phil.whineray@gmail.com>

Section: Appendix B.

Original Text
-------------
   if [ "$STATE_ENABLED" -eq "1" ]
   then
     # Allow incoming time exceeded code 0 messages
     # only for existing sessions
     for inner_prefix in $INNER_PREFIXES
     do
       ip6tables -A icmpv6-filter -m state -p icmpv6 \
            -d $inner_prefix \
            --state ESTABLISHED,RELATED --icmpv6-type packet-too-big \
            -j ACCEPT
     done
   else
     # Allow incoming time exceeded code 0 messages
     for inner_prefix in $INNER_PREFIXES
     do
       ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \
            --icmpv6-type ttl-zero-during-transit -j ACCEPT
     done
   fi


Corrected Text
--------------
   if [ "$STATE_ENABLED" -eq "1" ]
   then
     # Allow incoming time exceeded code 0 messages
     # only for existing sessions
     for inner_prefix in $INNER_PREFIXES
     do
       ip6tables -A icmpv6-filter -m state -p icmpv6 \
            -d $inner_prefix \
            --state ESTABLISHED,RELATED --icmpv6-type ttl-zero-during-transmit \
            -j ACCEPT
     done
   else
     # Allow incoming time exceeded code 0 messages
     for inner_prefix in $INNER_PREFIXES
     do
       ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \
            --icmpv6-type ttl-zero-during-transit -j ACCEPT
     done
   fi


Notes
-----
Not sure if this is really editorial as it is in the example code, not the main RFC.

In any case, the example incorrectly specifies an icmpv6 type in one code path.

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC4890 (draft-ietf-v6ops-icmpv6-filtering-recs-03)
--------------------------------------
Title               : Recommendations for Filtering ICMPv6 Messages in Firewalls
Publication Date    : May 2007
Author(s)           : E. Davies, J. Mohacsi
Category            : INFORMATIONAL
Source              : IPv6 Operations
Area                : Operations and Management
Stream              : IETF
Verifying Party     : IESG

[v6ops] [Technical Errata Reported] RFC4890 (2706) RFC Errata System