Re: [v6ops] Discussion focus: draft-ietf-v6ops-ipv6rtr-reqs-01.txt

[Pablo Alvarez <[e-mail]>]

Comments on section 5.4 ICMP Considerations

1. Thanks for adding the new text in the fifth bullet ("SHOULD NOT
filter Destination Unreachable or Packet..."). It was intended to
clarify and supersede the text in the first bullet ("SHOULD NOT filter
ICMP unreachables..."), so I do not think the first bullet is needed any
longer.

2. I believe the statement in the second bullet ("SHOULD filter ICMP
echo and echo response by default, to prevent the discovery of reachable
hosts and topology") is too strong. There are valid business and
research reasons to discover reachable hosts and topology. I understand
that obscurity is a valid security layer. However, it is not clear to me
that the security risks of that discovery or of ICMP based attacks are
high enough that we should recommend ICMP filtering by default.

Moreover, the text does not specify whether the filtering refers to all
echo and echo reply packets traversing the router (which I believe would
clearly be excessive) or only those intended for the router (which I
still would argue is too strong).

I propose the following. By default:

- ICMP echo request/reply packets not intended for the router should be
forwarded like any other packet

- ICMP echo request packets directed at the router should be
rate-limited to protect the router CPU (in a similar way to the error
packet generation described in the third bullet point).

- I have no strong opinion on ICMP echo reply packets directed at the
router. Pinging from a router can be a useful tool so we want to be able
to see those. Maybe blocking them by default unless the ping tool is in
use would work, but that adds complexity.


Pablo Alvarez


On 01/02/18 13:52, [e-mail] wrote:
> 
>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>> This draft is a work item of the IPv6 Operations WG of the IETF.
>>
>>         Title           : Requirements for IPv6 Routers
> 
> I've addressed all of the comments I had notes for except --
> 
> - Should PVD be included?
> - Add a redirects section -- I don't remember what this was in reference to.
> - The suggestion for an appendix containing a plain list of the requirements.
> 
> The first needs on list discussion, I think. For the second, I need to find the context. For the third -- I may add an appendix if we get to a version with no comments, if folks think it's useful.
> 
> 😊 /r 
> 
> _______________________________________________
> v6ops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/v6ops
>