Re: [v6ops] [Technical Errata Reported] RFC4890 (3985)

[Mohacsi Janos <[e-mail]>]

Dear Fred and alls,
 	I looked it, and it seems to me the errata should be accepted.
 	Kinest Regards,

Janos Mohacsi
Head of HBONE+ project
Network Engineer, Director Network and Multimedia
NIIF/HUNGARNET, HUNGARY
Co-chair of Hungarian IPv6 Forum
Key 70EF9882: DEC2 C685 1ED4 C95A 145F  4300 6F64 7B00 70EF 9882

On Thu, 15 May 2014, Fred Baker (fred) wrote:

> Guys:
>
> Do we agree with this?
>
> On May 13, 2014, at 5:07 PM, RFC Errata System <[e-mail]> wrote:
>
>> The following errata report has been submitted for RFC4890,
>> "Recommendations for Filtering ICMPv6 Messages in Firewalls".
>>
>> --------------------------------------
>> You may review the report below and at:
>> http://www.rfc-editor.org/errata_search.php?rfc=4890&eid=3985
>>
>> --------------------------------------
>> Type: Technical
>> Reported by: James Robertson <[e-mail]>
>>
>> Section: Appendix B
>>
>> Original Text
>> -------------
>> if [ "$STATE_ENABLED" -eq "1" ]
>> then
>>  # Allow incoming time exceeded code 0 messages
>>  # only for existing sessions
>>  for inner_prefix in $INNER_PREFIXES
>>  do
>>    ip6tables -A icmpv6-filter -m state -p icmpv6 \
>>         -d $inner_prefix \
>>         --state ESTABLISHED,RELATED --icmpv6-type packet-too-big \
>>         -j ACCEPT
>>  done
>> else
>>  # Allow incoming time exceeded code 0 messages
>>  for inner_prefix in $INNER_PREFIXES
>>  do
>>    ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \
>>         --icmpv6-type ttl-zero-during-transit -j ACCEPT
>>  done
>> fi
>>
>> Corrected Text
>> --------------
>> if [ "$STATE_ENABLED" -eq "1" ]
>> then
>>  # Allow incoming time exceeded code 0 messages
>>  # only for existing sessions
>>  for inner_prefix in $INNER_PREFIXES
>>  do
>>    ip6tables -A icmpv6-filter -m state -p icmpv6 \
>>     -d $inner_prefix \
>>     --state ESTABLISHED,RELATED --icmpv6-type ttl-zero-during-transit \
>>     -j ACCEPT
>>  done
>> else
>>  # Allow incoming time exceeded code 0 messages
>>  for inner_prefix in $INNER_PREFIXES
>>  do
>>    ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \
>>         --icmpv6-type ttl-zero-during-transit -j ACCEPT
>>  done
>> fi
>>
>> Notes
>> -----
>> RFC 4890 Errata ID 2706 states that icmpv6-type packet-too-big should
>> state icmpv6-type ttl-zero-during-transmit. This should read
>> ttl-zero-during-transit.
>>
>> Instructions:
>> -------------
>> This errata is currently posted as "Reported". If necessary, please
>> use "Reply All" to discuss whether it should be verified or
>> rejected. When a decision is reached, the verifying party (IESG)
>> can log in to change the status and edit the report, if necessary.
>>
>> --------------------------------------
>> RFC4890 (draft-ietf-v6ops-icmpv6-filtering-recs-03)
>> --------------------------------------
>> Title               : Recommendations for Filtering ICMPv6 Messages in Firewalls
>> Publication Date    : May 2007
>> Author(s)           : E. Davies, J. Mohacsi
>> Category            : INFORMATIONAL
>> Source              : IPv6 Operations
>> Area                : Operations and Management
>> Stream              : IETF
>> Verifying Party     : IESG
>
>