Subject: [NDProxy#22] Unclear text about ICMP errors

From: "Dave Thaler" <[email-masked]>
Date: Tue, 15 Feb 2005 20:39:12 -0800

Issue page:
http://www.icir.org/dthaler/NDProxyIssues.htm#Issue%2022

Section 4.1 stated no ICMP errors are sent:
OLD: In particular, the IPv4 TTL or IPv6 Hop Limit is not
updated, and no ICMP errors are sent as a result of attempting
this forwarding.
 
and
 
OLD: Again the IPv4 TTL or IPv6 Hop Limit is not
updated, and no ICMP errors are sent as a result of attempting
this forwarding.
 
While Section 4.1.1 stated (and only stated it for IPv6):
OLD: Whenever any packet is to be forwarded out an interface whose MTU
is smaller than the size of the packet, the ND proxy drops the
packet and sends a Packet Too Big message back to the source, as
described in [ICMPv6].
 
Proposed replacement text, to clarify intent:
 
In 4.1, replace the two sentences quoted with:

NEW: In particular, the IPv4 TTL or IPv6 Hop Limit is not 
updated, and no ICMP errors (except as noted in Section 4.1.1 
below) are sent as a result of attempting this forwarding.

NEW: Again the IPv4 TTL or IPv6 Hop Limit is not 
updated, and no ICMP errors (except as noted in Section 4.1.1 
below) are sent as a result of attempting this forwarding.
 
and replace the paragraph in 4.1.1 quoted above with:

Whenever any IPv4 packet is to be forwarded out an interface
whose MTU is smaller than the size of the packet, and the Dont 
Fragment bit is set, the ARP proxy drops the packet and sends 
a Fragmentation Needed message back to the source.

Similarly, whenever any IPv6 packet is to be forwarded out an
Interface whose MTU is smaller than the size of the packet, 
the ND proxy drops the packet and sends a Packet Too Big message
back to the source, as described in [ICMPv6].
 
-Dave

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 15 Feb 2005 21:45:52 -0800

> back to the source, as described in [ICMPv6].

Given that the proxy is invisible at L3, I think it would make sense to 
add explicit statements about any constraints on the IP source address 
to use when the proxy generates ICMP errors.

I believe the ICMPv* specifications say to use an IP address assigned to 
either the interface where the packet in error arrived, or assigned to 
the interface on which the error is sent, but in the case of a proxy 
there might be a single IP address assigned to all the proxy interfaces 
for all I know.

    Erik