Re: [v6ops] [Technical Errata Reported] RFC4890 (3985)
joel jaeggli <joelja@bogus.com> Wed, 21 May 2014 21:30 UTC
Return-Path: <joelja@bogus.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 883B91A02D1 for <v6ops@ietfa.amsl.com>; Wed, 21 May 2014 14:30:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.951
X-Spam-Level:
X-Spam-Status: No, score=-1.951 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, J_CHICKENPOX_26=0.6, RP_MATCHES_RCVD=-0.651] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S0abRAaIkgJo for <v6ops@ietfa.amsl.com>; Wed, 21 May 2014 14:30:08 -0700 (PDT)
Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACA3D1A075F for <v6ops@ietf.org>; Wed, 21 May 2014 14:30:08 -0700 (PDT)
Received: from mb-aye.local ([173.247.205.34]) (authenticated bits=0) by nagasaki.bogus.com (8.14.7/8.14.7) with ESMTP id s4LLTjD0018658 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Wed, 21 May 2014 21:29:45 GMT (envelope-from joelja@bogus.com)
Message-ID: <537D1AC8.6070200@bogus.com>
Date: Wed, 21 May 2014 14:29:44 -0700
From: joel jaeggli <joelja@bogus.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:29.0) Gecko/20100101 Thunderbird/29.0
MIME-Version: 1.0
To: "Fred Baker (fred)" <fred@cisco.com>, Elwyn Davies <elwynd@dial.pipex.com>
References: <20140514000750.1AF7818000E@rfc-editor.org> <8DA928AC-FCAF-4AB6-BE39-C6D155C91F17@cisco.com> <53743DEA.4030703@bogus.com> <1400149479.29419.2590.camel@mightyatom> <10FBEF6F-DD9D-4DA6-89A6-8699110270B4@cisco.com>
In-Reply-To: <10FBEF6F-DD9D-4DA6-89A6-8699110270B4@cisco.com>
X-Enigmail-Version: 1.6
Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature"; boundary="gvvftjI3A8WWjvmnViCFBigipHNNhjULn"
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.4.3 (nagasaki.bogus.com [147.28.0.81]); Wed, 21 May 2014 21:29:47 +0000 (UTC)
Archived-At: http://mailarchive.ietf.org/arch/msg/v6ops/xwhC4yaRfTInuo7qNu0b-RFwHRo
Cc: V6 Ops List <v6ops@ietf.org>, "jamesrobertson@live.com" <jamesrobertson@live.com>
Subject: Re: [v6ops] [Technical Errata Reported] RFC4890 (3985)
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 May 2014 21:30:11 -0000
Thanks, just to confirm with you guys that I verified that errata. joel On 5/15/14, 7:44 AM, Fred Baker (fred) wrote: > Thanks > > On May 15, 2014, at 3:24 AM, Elwyn Davies <elwynd@dial.pipex.com> wrote: > >> HI. >> >> This looks correct. I am forwarding the message to Suresh who actually >> authored the script for an opinion. >> >> Assuming that he concurs, I don't see any harm in issuing an erratum and >> a very few people might actually be using the script verbatim. >> >> There was a move afoot to make a new version (and possibly transition >> this to BCP) but we haven't managed to get it together to do so yet. >> >> Regards, >> Elwyn >> >> On Wed, 2014-05-14 at 21:09 -0700, joel jaeggli wrote: >>> On 5/14/14, 8:25 PM, Fred Baker (fred) wrote: >>>> Guys: >>>> >>>> Do we agree with this? >>> >>> it's not really normative text, it's an example in an appendix. >>> >>> assuming you think it's an issue and the correction is reasonable I >>> would probably just hold it for a document update (seems unlikely atm >>> but who knows) >>> >>> >>>> On May 13, 2014, at 5:07 PM, RFC Errata System <rfc-editor@rfc-editor.org> wrote: >>>> >>>>> The following errata report has been submitted for RFC4890, >>>>> "Recommendations for Filtering ICMPv6 Messages in Firewalls". >>>>> >>>>> -------------------------------------- >>>>> You may review the report below and at: >>>>> http://www.rfc-editor.org/errata_search.php?rfc=4890&eid=3985 >>>>> >>>>> -------------------------------------- >>>>> Type: Technical >>>>> Reported by: James Robertson <jamesrobertson@live.com> >>>>> >>>>> Section: Appendix B >>>>> >>>>> Original Text >>>>> ------------- >>>>> if [ "$STATE_ENABLED" -eq "1" ] >>>>> then >>>>> # Allow incoming time exceeded code 0 messages >>>>> # only for existing sessions >>>>> for inner_prefix in $INNER_PREFIXES >>>>> do >>>>> ip6tables -A icmpv6-filter -m state -p icmpv6 \ >>>>> -d $inner_prefix \ >>>>> --state ESTABLISHED,RELATED --icmpv6-type packet-too-big \ >>>>> -j ACCEPT >>>>> done >>>>> else >>>>> # Allow incoming time exceeded code 0 messages >>>>> for inner_prefix in $INNER_PREFIXES >>>>> do >>>>> ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \ >>>>> --icmpv6-type ttl-zero-during-transit -j ACCEPT >>>>> done >>>>> fi >>>>> >>>>> Corrected Text >>>>> -------------- >>>>> if [ "$STATE_ENABLED" -eq "1" ] >>>>> then >>>>> # Allow incoming time exceeded code 0 messages >>>>> # only for existing sessions >>>>> for inner_prefix in $INNER_PREFIXES >>>>> do >>>>> ip6tables -A icmpv6-filter -m state -p icmpv6 \ >>>>> -d $inner_prefix \ >>>>> --state ESTABLISHED,RELATED --icmpv6-type ttl-zero-during-transit \ >>>>> -j ACCEPT >>>>> done >>>>> else >>>>> # Allow incoming time exceeded code 0 messages >>>>> for inner_prefix in $INNER_PREFIXES >>>>> do >>>>> ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \ >>>>> --icmpv6-type ttl-zero-during-transit -j ACCEPT >>>>> done >>>>> fi >>>>> >>>>> Notes >>>>> ----- >>>>> RFC 4890 Errata ID 2706 states that icmpv6-type packet-too-big should >>>>> state icmpv6-type ttl-zero-during-transmit. This should read >>>>> ttl-zero-during-transit. >>>>> >>>>> Instructions: >>>>> ------------- >>>>> This errata is currently posted as "Reported". If necessary, please >>>>> use "Reply All" to discuss whether it should be verified or >>>>> rejected. When a decision is reached, the verifying party (IESG) >>>>> can log in to change the status and edit the report, if necessary. >>>>> >>>>> -------------------------------------- >>>>> RFC4890 (draft-ietf-v6ops-icmpv6-filtering-recs-03) >>>>> -------------------------------------- >>>>> Title : Recommendations for Filtering ICMPv6 Messages in Firewalls >>>>> Publication Date : May 2007 >>>>> Author(s) : E. Davies, J. Mohacsi >>>>> Category : INFORMATIONAL >>>>> Source : IPv6 Operations >>>>> Area : Operations and Management >>>>> Stream : IETF >>>>> Verifying Party : IESG >>>> >>> >>> >> >
- [v6ops] [Technical Errata Reported] RFC4890 (3985) RFC Errata System
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Fred Baker (fred)
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… joel jaeggli
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Elwyn Davies
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Fred Baker (fred)
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Suresh Krishnan
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Mohacsi Janos
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Fred Baker (fred)
- [v6ops] [Errata Verified] RFC4890 (3985) RFC Errata System
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… joel jaeggli
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Elwyn Davies
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… joel jaeggli