Re: [v6ops] Last Call: <draft-ietf-v6ops-ra-guard-implementation-04.txt>

[RJ Atkinson <[e-mail]>]

At this point, my understanding is that Fernando has agreed
to make some edits to draft-ietf-v6ops-ra-guard-implementation
to resolve the concerns raised on the v6ops list.

These edits include at least:
-- adding the 2 IPv6 specification update I-Ds as normative references,
   draft-gont-6man-nd-extension-headers and also
   draft-gont-6man-oversized-header-chain, so that the IETF avoids 
   recommending that RA Guard implementers violate the IETF IPv6 
   specifications.

-- updating the Security Considerations as discussed on v6ops,
   and to note the potential that deploying the RA Guard can 
   create a new DoS attack vector (e.g. on the RA Guard itself).

-- editing the RA Guard text to improve the crispness/clarity
   of the implementation requirements & also eliminating the
   situation where an RA Guard would drop a valid IPv6 packet
   (example: RA Guard MUST parse the packet's whole IPv6 header chain,
    thereby eliminating the situation where a correct RA Guard
    implementation might not know whether a packet is valid or not)

For my part, I hope the 6MAN WG will approve the 2 specification
updates in the first item listed above, and undertake that soon.  
(I don't expect the proposed updates will be controversial in 6MAN, 
but often I am confused.)

I'm unclear whether text specific to the SEND situation might be
added or not, but it might well be sensible to add some text,
since SEND is cryptographically authenticated (so forged RAs
would be dropped by recipients as "authentication failed").

Yours,

Ran