Re: [v6ops] RFC 6092 [was draft-ietf-v6ops-balanced-ipv6-security WGLC]

[Brian E Carpenter <[e-mail]>]

On 21/11/2013 19:51, Marc Lampo wrote:
> A pity that the text can be interpreted in various ways and that those lead
> to completely opposite results.

Well yes, I'd say that text is unclear and should have been fixed before
publication. However, when you think of how to implement it, the requirement
to wait at least 6 seconds tells you that (a) the firewall is stateful and
(b) there might be a response packet coming, so the firewall must have
forwarded the incoming SYN.

> 
> (written by a politician ? ;-)

No, just a careless engineer, and reviewed by other careless engineers!
We all share the blame ;-)

    Brian

> 
> 
> On Wed, Nov 20, 2013 at 8:42 PM, Brian E Carpenter <
> [e-mail]> wrote:
> 
>> On 20/11/2013 22:37, Marc Lampo wrote:
>>> Yes, RFC 6092 recommends that unsolicited packets be dropped by default !
>>>
>>>   REC-34  By DEFAULT, a gateway MUST respond with an ICMPv6
>>>            "Destination Unreachable" error code 1 (Communication with
>>>            destination administratively prohibited), to any unsolicited
>>>            inbound SYN packet after waiting at least 6 seconds without
>>>            first forwarding the associated outbound SYN or SYN/ACK from
>>>            the interior peer.
>> Er, no, it recommends that unacknowledged unsolicited SYNs should cause
>> Destination Unreachable, if no TCP listener has responded after 6 seconds.
>> The gateway isn't dropping anything. It is required to be stateful for
>> 6 seconds in case there is a response.
>>
>>> "transparent mode" "MAY" be the default (which, in the context, I
>> interpret
>>> as a kind of "second choice")
>> That interpretation is not justified by RFC 2119.
>>
>>>    REC-49  Internet gateways with IPv6 simple security capabilities MUST
>>>            provide an easily selected configuration option that permits
>>>            a "transparent mode" of operation that forwards all
>>>            unsolicited flows regardless of forwarding direction, i.e.,
>>>            not to use the IPv6 simple security capabilities of the
>>>            gateway.  The transparent mode of operation MAY be the
>>>            default configuration.
>>    Brian
>>
>>
>