Re: [v6ops] RFC 6092 [was draft-ietf-v6ops-balanced-ipv6-security WGLC]

On Nov 21, 2013 11:23 AM, "Brian E Carpenter" <brian.e.carpenter@gmail.com>
wrote:
>
> On 21/11/2013 19:51, Marc Lampo wrote:
> > A pity that the text can be interpreted in various ways and that those
lead
> > to completely opposite results.
>
> Well yes, I'd say that text is unclear and should have been fixed before
> publication. However, when you think of how to implement it, the
requirement
> to wait at least 6 seconds tells you that (a) the firewall is stateful and
> (b) there might be a response packet coming, so the firewall must have
> forwarded the incoming SYN.
>
> >
> > (written by a politician ? ;-)
>
> No, just a careless engineer, and reviewed by other careless engineers!
> We all share the blame ;-)
>

Well.  The stateful inspection debate did not have a strong consensus then,
like now.

When consensus is weak, the guidance is weak. Death by 1,000 cuts.

Many network operators think stateful inspection is an Achilles heel of a
network and an affront to the internet model (me) .Others think it is a
"must have"  .

The ietf should not guide either way since there is no strong consensus.

This I-D is very useful for networks that choose no stateful inspection of
ipv6 -- including me, Swisscom,  Alitbox...

CB

>     Brian
>
> >
> >
> > On Wed, Nov 20, 2013 at 8:42 PM, Brian E Carpenter <
> > brian.e.carpenter@gmail.com> wrote:
> >
> >> On 20/11/2013 22:37, Marc Lampo wrote:
> >>> Yes, RFC 6092 recommends that unsolicited packets be dropped by
default !
> >>>
> >>>   REC-34  By DEFAULT, a gateway MUST respond with an ICMPv6
> >>>            "Destination Unreachable" error code 1 (Communication with
> >>>            destination administratively prohibited), to any
unsolicited
> >>>            inbound SYN packet after waiting at least 6 seconds without
> >>>            first forwarding the associated outbound SYN or SYN/ACK
from
> >>>            the interior peer.
> >> Er, no, it recommends that unacknowledged unsolicited SYNs should cause
> >> Destination Unreachable, if no TCP listener has responded after 6
seconds.
> >> The gateway isn't dropping anything. It is required to be stateful for
> >> 6 seconds in case there is a response.
> >>
> >>> "transparent mode" "MAY" be the default (which, in the context, I
> >> interpret
> >>> as a kind of "second choice")
> >> That interpretation is not justified by RFC 2119.
> >>
> >>>    REC-49  Internet gateways with IPv6 simple security capabilities
MUST
> >>>            provide an easily selected configuration option that
permits
> >>>            a "transparent mode" of operation that forwards all
> >>>            unsolicited flows regardless of forwarding direction, i.e.,
> >>>            not to use the IPv6 simple security capabilities of the
> >>>            gateway.  The transparent mode of operation MAY be the
> >>>            default configuration.
> >>    Brian
> >>
> >>
> >
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops