Re: [v6ops] Last Call: <draft-ietf-v6ops-ra-guard-implementation-04.txt> (Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard)) to Best Current Practice

[RJ Atkinson <[e-mail]>]

Earlier, Joel Halpern wrote:
> It seems that the right answer was discussed much earlier, namely
> changing the protocol behavior (a 6man activity) to tell hosts to
> reject RA and ND packets which were received in fragments.


Earlier, Ron Bonica wrote:
> I would be thrilled if the 6man WG would update RFC 4443 to say something like:
> "ICMPv6 packets MUST NOT be fragmented unless the ICMPv6 Type, Code, and Checksum 
> all fit in the first fragment".


I support Joel and Ron in this.  


A better approach for the RA Guard document would be:

1) to put together a separate I-D for 6MAN that says approximately 
   the above (and explains why).  There is probably a little text
   clarifying that any host receiving an RA that did not comply with
   the proposed new rule above MUST be dropped by that receiving host.

   One imagines this would not be controversial within 6MAN and could 
   proceed quickly.  If it were controversial there, that would 
   tend to indicate a significant problem with the current RA Guard text.

   This would be a more comprehensive protection.  Ultimately, the
   risk of unauthorised RA messages is a risk to the hosts, so host IPv6
   implementers have strong incentive to update their stacks quickly 
   once the IPv6 specifications are updated accordingly.  



2) in parallel with (1), revise the RA Guard I-D to either delete
   "Rule 4" (e.g. citing the proposed new rule above) or invert the
   meaning of Rule 4.  Either way, the objective would be that all 
   valid IPv6 packets are passed by an RA Guard all the time.


Yours,

Ran

PS:  It seems to me that the V6 OPS WG ought not be recommending 
     behaviours that violate the IPv6 specifications.  Instead, 
     if situations arise where V6 OPS thinks the specified behaviour 
     is either wrong or incompletely described, then someone should 
     propose an IPv6 specification update/edit/correction to the 6MAN WG.