Re: [v6ops] [Technical Errata Reported] RFC4890 (3985)
"Fred Baker (fred)" <fred@cisco.com> Sun, 18 May 2014 21:05 UTC
Return-Path: <fred@cisco.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7250A1A02D3 for <v6ops@ietfa.amsl.com>; Sun, 18 May 2014 14:05:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -111.852
X-Spam-Level:
X-Spam-Status: No, score=-111.852 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, J_CHICKENPOX_26=0.6, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.651, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jSURa4mbWoDm for <v6ops@ietfa.amsl.com>; Sun, 18 May 2014 14:05:39 -0700 (PDT)
Received: from alln-iport-2.cisco.com (alln-iport-2.cisco.com [173.37.142.89]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98E9C1A02AC for <v6ops@ietf.org>; Sun, 18 May 2014 14:05:39 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3588; q=dns/txt; s=iport; t=1400447140; x=1401656740; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=aHXMISSJwkCYlaAeMdpHCCmtfZ4ttx6PMK6ctNkCU3A=; b=KfoQzP0vu+Wenp58BbnDRtTXO51gfWgqqrnRqXutVxFeY5MThxFzqjwP K20931zKgfXq2xt5idcfWj83wWMxBkHrXxuH2T0PuniA/Ape/kYWdeLHH fR4GuijFlyU73A/TLP2hmXTzzgRIPREGv2vXs3eR4uo9vJ4YXMYdeb7I0 Y=;
X-Files: signature.asc : 195
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: Am8FAGAfeVOtJV2Z/2dsb2JhbAA/GoMGT1isEJd4AYELFnSCJQEBAQMBeQULAgEIRjIlAgQBDQUOiB8DCQgNNtBNF4tCeYE0YQeDK4EVBJE6gTqGZpMagzdtEXFB
X-IronPort-AV: E=Sophos;i="4.98,863,1392163200"; d="asc'?scan'208";a="44916002"
Received: from rcdn-core-2.cisco.com ([173.37.93.153]) by alln-iport-2.cisco.com with ESMTP; 18 May 2014 21:05:38 +0000
Received: from xhc-aln-x14.cisco.com (xhc-aln-x14.cisco.com [173.36.12.88]) by rcdn-core-2.cisco.com (8.14.5/8.14.5) with ESMTP id s4IL5cqF008797 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Sun, 18 May 2014 21:05:38 GMT
Received: from xmb-rcd-x09.cisco.com ([169.254.9.239]) by xhc-aln-x14.cisco.com ([173.36.12.88]) with mapi id 14.03.0123.003; Sun, 18 May 2014 16:05:37 -0500
From: "Fred Baker (fred)" <fred@cisco.com>
To: RFC Errata System <rfc-editor@rfc-editor.org>, joel jaeggli <joelja@bogus.com>
Thread-Topic: [Technical Errata Reported] RFC4890 (3985)
Thread-Index: AQHPctzq8qN6nK86IUeel0sJIo+V+A==
Date: Sun, 18 May 2014 21:05:37 +0000
Message-ID: <797B02F7-6639-49A7-90D1-DF3C95BD1396@cisco.com>
References: <20140514000750.1AF7818000E@rfc-editor.org>
In-Reply-To: <20140514000750.1AF7818000E@rfc-editor.org>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-originating-ip: [10.19.64.123]
Content-Type: multipart/signed; boundary="Apple-Mail=_863C51DE-0868-4AE6-AE20-141C5113EAFA"; protocol="application/pgp-signature"; micalg="pgp-sha1"
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/v6ops/yckWI273GbAHX8PVb6n_Qe6ry1c
Cc: IPv6 Ops WG <v6ops@ietf.org>, "jamesrobertson@live.com" <jamesrobertson@live.com>
Subject: Re: [v6ops] [Technical Errata Reported] RFC4890 (3985)
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 18 May 2014 21:05:41 -0000
I gather the erratum should be accepted. Apparently that’s your todo, Joel. On May 13, 2014, at 5:07 PM, RFC Errata System <rfc-editor@rfc-editor.org> wrote: > The following errata report has been submitted for RFC4890, > "Recommendations for Filtering ICMPv6 Messages in Firewalls". > > -------------------------------------- > You may review the report below and at: > http://www.rfc-editor.org/errata_search.php?rfc=4890&eid=3985 > > -------------------------------------- > Type: Technical > Reported by: James Robertson <jamesrobertson@live.com> > > Section: Appendix B > > Original Text > ------------- > if [ "$STATE_ENABLED" -eq "1" ] > then > # Allow incoming time exceeded code 0 messages > # only for existing sessions > for inner_prefix in $INNER_PREFIXES > do > ip6tables -A icmpv6-filter -m state -p icmpv6 \ > -d $inner_prefix \ > --state ESTABLISHED,RELATED --icmpv6-type packet-too-big \ > -j ACCEPT > done > else > # Allow incoming time exceeded code 0 messages > for inner_prefix in $INNER_PREFIXES > do > ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \ > --icmpv6-type ttl-zero-during-transit -j ACCEPT > done > fi > > Corrected Text > -------------- > if [ "$STATE_ENABLED" -eq "1" ] > then > # Allow incoming time exceeded code 0 messages > # only for existing sessions > for inner_prefix in $INNER_PREFIXES > do > ip6tables -A icmpv6-filter -m state -p icmpv6 \ > -d $inner_prefix \ > --state ESTABLISHED,RELATED --icmpv6-type ttl-zero-during-transit \ > -j ACCEPT > done > else > # Allow incoming time exceeded code 0 messages > for inner_prefix in $INNER_PREFIXES > do > ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \ > --icmpv6-type ttl-zero-during-transit -j ACCEPT > done > fi > > Notes > ----- > RFC 4890 Errata ID 2706 states that icmpv6-type packet-too-big should > state icmpv6-type ttl-zero-during-transmit. This should read > ttl-zero-during-transit. > > Instructions: > ------------- > This errata is currently posted as "Reported". If necessary, please > use "Reply All" to discuss whether it should be verified or > rejected. When a decision is reached, the verifying party (IESG) > can log in to change the status and edit the report, if necessary. > > -------------------------------------- > RFC4890 (draft-ietf-v6ops-icmpv6-filtering-recs-03) > -------------------------------------- > Title : Recommendations for Filtering ICMPv6 Messages in Firewalls > Publication Date : May 2007 > Author(s) : E. Davies, J. Mohacsi > Category : INFORMATIONAL > Source : IPv6 Operations > Area : Operations and Management > Stream : IETF > Verifying Party : IESG
- [v6ops] [Technical Errata Reported] RFC4890 (3985) RFC Errata System
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Fred Baker (fred)
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… joel jaeggli
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Elwyn Davies
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Fred Baker (fred)
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Suresh Krishnan
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Mohacsi Janos
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Fred Baker (fred)
- [v6ops] [Errata Verified] RFC4890 (3985) RFC Errata System
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… joel jaeggli
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… Elwyn Davies
- Re: [v6ops] [Technical Errata Reported] RFC4890 (… joel jaeggli