Re: [v6ops] [Technical Errata Reported] RFC4890 (3985)
Elwyn Davies <elwynd@dial.pipex.com> Thu, 15 May 2014 10:24 UTC
Return-Path: <elwynd@dial.pipex.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A838C1A04A6 for <v6ops@ietfa.amsl.com>; Thu, 15 May 2014 03:24:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.3
X-Spam-Level:
X-Spam-Status: No, score=-101.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, J_CHICKENPOX_26=0.6, USER_IN_WHITELIST=-100] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AsMGJHkDGWVk for <v6ops@ietfa.amsl.com>; Thu, 15 May 2014 03:24:56 -0700 (PDT)
Received: from b.painless.aa.net.uk (b.painless.aa.net.uk [IPv6:2001:8b0:0:30::51bb:1e34]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2FCF01A04A8 for <v6ops@ietf.org>; Thu, 15 May 2014 03:24:55 -0700 (PDT)
Received: from mightyatom.folly.org.uk ([81.187.254.250]) by b.painless.aa.net.uk with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from <elwynd@dial.pipex.com>) id 1WksqA-0000jK-Hj; Thu, 15 May 2014 11:24:42 +0100
From: Elwyn Davies <elwynd@dial.pipex.com>
To: joel jaeggli <joelja@bogus.com>, Suresh Krishnan <suresh.krishnan@ericsson.com>
In-Reply-To: <53743DEA.4030703@bogus.com>
References: <20140514000750.1AF7818000E@rfc-editor.org> <8DA928AC-FCAF-4AB6-BE39-C6D155C91F17@cisco.com> <53743DEA.4030703@bogus.com>
Content-Type: text/plain
Date: Thu, 15 May 2014 11:24:39 +0100
Message-Id: <1400149479.29419.2590.camel@mightyatom>
Mime-Version: 1.0
X-Mailer: Evolution 2.26.3
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/v6ops/m8olZYZKAHjFYmMhyzDOinS-FTc
Cc: V6 Ops List <v6ops@ietf.org>, "jamesrobertson@live.com" <jamesrobertson@live.com>
Subject: Re: [v6ops] [Technical Errata Reported] RFC4890 (3985)
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 15 May 2014 10:24:58 -0000
HI. This looks correct. I am forwarding the message to Suresh who actually authored the script for an opinion. Assuming that he concurs, I don't see any harm in issuing an erratum and a very few people might actually be using the script verbatim. There was a move afoot to make a new version (and possibly transition this to BCP) but we haven't managed to get it together to do so yet. Regards, Elwyn On Wed, 2014-05-14 at 21:09 -0700, joel jaeggli wrote: > On 5/14/14, 8:25 PM, Fred Baker (fred) wrote: > > Guys: > > > > Do we agree with this? > > it's not really normative text, it's an example in an appendix. > > assuming you think it's an issue and the correction is reasonable I > would probably just hold it for a document update (seems unlikely atm > but who knows) > > > > On May 13, 2014, at 5:07 PM, RFC Errata System <rfc-editor@rfc-editor.org> wrote: > > > >> The following errata report has been submitted for RFC4890, > >> "Recommendations for Filtering ICMPv6 Messages in Firewalls". > >> > >> -------------------------------------- > >> You may review the report below and at: > >> http://www.rfc-editor.org/errata_search.php?rfc=4890&eid=3985 > >> > >> -------------------------------------- > >> Type: Technical > >> Reported by: James Robertson <jamesrobertson@live.com> > >> > >> Section: Appendix B > >> > >> Original Text > >> ------------- > >> if [ "$STATE_ENABLED" -eq "1" ] > >> then > >> # Allow incoming time exceeded code 0 messages > >> # only for existing sessions > >> for inner_prefix in $INNER_PREFIXES > >> do > >> ip6tables -A icmpv6-filter -m state -p icmpv6 \ > >> -d $inner_prefix \ > >> --state ESTABLISHED,RELATED --icmpv6-type packet-too-big \ > >> -j ACCEPT > >> done > >> else > >> # Allow incoming time exceeded code 0 messages > >> for inner_prefix in $INNER_PREFIXES > >> do > >> ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \ > >> --icmpv6-type ttl-zero-during-transit -j ACCEPT > >> done > >> fi > >> > >> Corrected Text > >> -------------- > >> if [ "$STATE_ENABLED" -eq "1" ] > >> then > >> # Allow incoming time exceeded code 0 messages > >> # only for existing sessions > >> for inner_prefix in $INNER_PREFIXES > >> do > >> ip6tables -A icmpv6-filter -m state -p icmpv6 \ > >> -d $inner_prefix \ > >> --state ESTABLISHED,RELATED --icmpv6-type ttl-zero-during-transit \ > >> -j ACCEPT > >> done > >> else > >> # Allow incoming time exceeded code 0 messages > >> for inner_prefix in $INNER_PREFIXES > >> do > >> ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \ > >> --icmpv6-type ttl-zero-during-transit -j ACCEPT > >> done > >> fi > >> > >> Notes > >> ----- > >> RFC 4890 Errata ID 2706 states that icmpv6-type packet-too-big should > >> state icmpv6-type ttl-zero-during-transmit. This should read > >> ttl-zero-during-transit. > >> > >> Instructions: > >> ------------- > >> This errata is currently posted as "Reported". If necessary, please > >> use "Reply All" to discuss whether it should be verified or > >> rejected. When a decision is reached, the verifying party (IESG) > >> can log in to change the status and edit the report, if necessary. > >> > >> -------------------------------------- > >> RFC4890 (draft-ietf-v6ops-icmpv6-filtering-recs-03) > >> -------------------------------------- > >> Title : Recommendations for Filtering ICMPv6 Messages in Firewalls > >> Publication Date : May 2007 > >> Author(s) : E. Davies, J. Mohacsi > >> Category : INFORMATIONAL > >> Source : IPv6 Operations > >> Area : Operations and Management > >> Stream : IETF > >> Verifying Party : IESG > > > >
- [v6ops] [Technical Errata Reported] RFC4890 (3985) RFC Errata System
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Fred Baker (fred)
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… joel jaeggli
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Elwyn Davies
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Fred Baker (fred)
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Suresh Krishnan
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Mohacsi Janos
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Fred Baker (fred)
- [v6ops] [Errata Verified] RFC4890 (3985) RFC Errata System
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… joel jaeggli
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Elwyn Davies
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… joel jaeggli