Re: [v6ops] [Technical Errata Reported] RFC4890 (3985)

["Fred Baker (fred)" <[e-mail]>]

Thanks

On May 15, 2014, at 3:24 AM, Elwyn Davies <[e-mail]> wrote:

> HI.
> 
> This looks correct.  I am forwarding the message to Suresh who actually
> authored the script for an opinion.
> 
> Assuming that he concurs, I don't see any harm in issuing an erratum and
> a very few people might actually be using the script verbatim.
> 
> There was a move afoot to make a new version (and possibly transition
> this to BCP) but we haven't managed to get it together to do so yet.
> 
> Regards,
> Elwyn
> 
> On Wed, 2014-05-14 at 21:09 -0700, joel jaeggli wrote:
>> On 5/14/14, 8:25 PM, Fred Baker (fred) wrote:
>>> Guys:
>>> 
>>> Do we agree with this?
>> 
>> it's not really normative text, it's an example in an appendix.
>> 
>> assuming you think it's an issue  and the correction is reasonable I
>> would probably just hold it for a document update (seems unlikely atm
>> but who knows)
>> 
>> 
>>> On May 13, 2014, at 5:07 PM, RFC Errata System <[e-mail]> wrote:
>>> 
>>>> The following errata report has been submitted for RFC4890,
>>>> "Recommendations for Filtering ICMPv6 Messages in Firewalls".
>>>> 
>>>> --------------------------------------
>>>> You may review the report below and at:
>>>> http://www.rfc-editor.org/errata_search.php?rfc=4890&eid=3985
>>>> 
>>>> --------------------------------------
>>>> Type: Technical
>>>> Reported by: James Robertson <[e-mail]>
>>>> 
>>>> Section: Appendix B
>>>> 
>>>> Original Text
>>>> -------------
>>>> if [ "$STATE_ENABLED" -eq "1" ]
>>>> then
>>>> # Allow incoming time exceeded code 0 messages
>>>> # only for existing sessions
>>>> for inner_prefix in $INNER_PREFIXES
>>>> do
>>>>   ip6tables -A icmpv6-filter -m state -p icmpv6 \
>>>>        -d $inner_prefix \
>>>>        --state ESTABLISHED,RELATED --icmpv6-type packet-too-big \
>>>>        -j ACCEPT
>>>> done
>>>> else
>>>> # Allow incoming time exceeded code 0 messages
>>>> for inner_prefix in $INNER_PREFIXES
>>>> do
>>>>   ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \
>>>>        --icmpv6-type ttl-zero-during-transit -j ACCEPT
>>>> done
>>>> fi
>>>> 
>>>> Corrected Text
>>>> --------------
>>>> if [ "$STATE_ENABLED" -eq "1" ]
>>>> then
>>>> # Allow incoming time exceeded code 0 messages
>>>> # only for existing sessions
>>>> for inner_prefix in $INNER_PREFIXES
>>>> do
>>>>   ip6tables -A icmpv6-filter -m state -p icmpv6 \
>>>>    -d $inner_prefix \
>>>>    --state ESTABLISHED,RELATED --icmpv6-type ttl-zero-during-transit \
>>>>    -j ACCEPT
>>>> done
>>>> else
>>>> # Allow incoming time exceeded code 0 messages
>>>> for inner_prefix in $INNER_PREFIXES
>>>> do
>>>>   ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \
>>>>        --icmpv6-type ttl-zero-during-transit -j ACCEPT
>>>> done
>>>> fi
>>>> 
>>>> Notes
>>>> -----
>>>> RFC 4890 Errata ID 2706 states that icmpv6-type packet-too-big should
>>>> state icmpv6-type ttl-zero-during-transmit. This should read
>>>> ttl-zero-during-transit.
>>>> 
>>>> Instructions:
>>>> -------------
>>>> This errata is currently posted as "Reported". If necessary, please
>>>> use "Reply All" to discuss whether it should be verified or
>>>> rejected. When a decision is reached, the verifying party (IESG)
>>>> can log in to change the status and edit the report, if necessary. 
>>>> 
>>>> --------------------------------------
>>>> RFC4890 (draft-ietf-v6ops-icmpv6-filtering-recs-03)
>>>> --------------------------------------
>>>> Title               : Recommendations for Filtering ICMPv6 Messages in Firewalls
>>>> Publication Date    : May 2007
>>>> Author(s)           : E. Davies, J. Mohacsi
>>>> Category            : INFORMATIONAL
>>>> Source              : IPv6 Operations
>>>> Area                : Operations and Management
>>>> Stream              : IETF
>>>> Verifying Party     : IESG
>>> 
>> 
>> 
>