Re: [v6ops] new draft: draft-ietf-v6ops-ra-guard-implementation

[Ray Hunter <[e-mail]>]

I have read this document. I find it well written and easy to follow. I 
also think it contains important information for the operational 
community. Thanks.

One thing I do not find satisfactory is one of the MUST drop rules:

> 3.  If the layer-2 device is unable to identify whether the packet is
>         an ICMPv6 Router Advertisement message or not (i.e., the packet
>         is a fragment, and the necessary information is missing), the
>         IPv6 Source Address of the packet is a link-local address or the
>         unspecified address (::), and the Hop Limit is 255, silently drop
>         the packet.
I understand the logic of the rule. But to me this suggests that the RA 
Guard filtering mechanism may well exceed its raison d'etre of layer 2 
filtering of unauthorized RA messages. I get the feeling therefore that 
the detection/definition of what is an unauthorized RA message may 
currently be underspecified. Or else the RA message itself is currently 
specified in such a way that the RA Guard filtering approach is not 
viable, as it may be circumvented by other yet-to-be-discovered cloaking 
mechanisms.

This rule we may also be in danger of heralding in a "drop all source 
<link-local-address> hop-limit 255 unless" layer-2 filter to cover a 
multitude of evils for various protocols and messages.

What other legitimate traffic would/could this rule potentially break?

regards
RayH

[e-mail] wrote:
> A new draft has been posted, at http://tools.ietf.org/html/draft-ietf-v6ops-ra-guard-implementation. Please take a look at it and comment.
>
>