Subject: Re: I-D Action: draft-bonica-6man-deprecate-router-alert-00.txt

From: Brian E Carpenter <[email-masked]>
Date: Fri, 31 Dec 2021 13:48:33 +1300

Hi,

I get the motivation for this draft. However, I think it is a bit unclear
about what it actually implies.

Specifically, MLDv2 (RFC3810) is a MUST in Node Requirements (BCP220/RFC8504)
and Router Alert (RFC2711) is a MUST in MLDv2. Also, MLDv2 is a must-have
in the real world.

So

a) I think section 3 "Updates To RFC 2711" needs to make it clear that the
requirement for MLDv2 in BCP220 is not changed. You aren't proposing
to make RFC2711 obsolete, because it is a normative reference for MLDv2.
In fact, the draft doesn't update RFC2711 by even a comma, so the section
title is plain wrong.

b) I am not sure that this should be standards track. It seems to me much
more like an update to Node Requirements, i.e. its natural destination is
as an update of BCP220. By the way, BCP220 already says:
"The Router Alert option will need to be implemented whenever such
protocols that mandate its use are implemented." You probably want to
update that sentence. It could be updated to say:
"The Router Alert option MUST NOT be implemented unless such
protocols that mandate its use are implemented."

As far as I can tell there's nothing else in BCP220 that is affected,
but the practical implication is surely that no existing router that
supports MLDv2 will be touched.

Regards
    Brian Carpenter

On 31-Dec-21 11:50, [email-masked] wrote:
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> 
> 
>          Title           : Deprecation Of The IPv6 Router Alert Option
>          Author          : Ron Bonica
> 	Filename        : draft-bonica-6man-deprecate-router-alert-00.txt
> 	Pages           : 8
> 	Date            : 2021-12-30
> 
> Abstract:
>     This document deprecates the IPv6 Router Alert Option.  Protocols
>     that use the Router Alert Option may continue to do so.  However,
>     protocols standardized in the future must not use the Router Alert
>     Option.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-bonica-6man-deprecate-router-alert/
> 
> There is also an htmlized version available at:
> https://datatracker.ietf.org/doc/html/draft-bonica-6man-deprecate-router-alert-00
> 
> 
> Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts
> 
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>

---

From: "Manfredi (US), Albert E" <[email-masked]>
Date: Fri, 31 Dec 2021 01:44:17 +0000

-----Original Message-----
From: ipv6 <[email-masked]> On Behalf Of Brian E Carpenter

My take was, we also need an update to RFC 3810 and RFC 4604. No? If Router Alert has to be deprecated, for security reasons, then how can Router Alert remain a MUST, in IGMPv3 and MLDv2?

It's either a significant security threat, or it's not. I think Router Alert should be deprecated, in those RFCs, or what's the point? (I was actually looking forward to this simplification.)

Bert

---

From: "Joel M. Halpern" <[email-masked]>
Date: Thu, 30 Dec 2021 21:12:21 -0500

As I read Ron's description, he was looking to make sure that no new 
standards attempted to use Router Alert.  Your proposed approach would 
not seem to accomplish that.

Yours,
Joel

On 12/30/2021 7:48 PM, Brian E Carpenter wrote:
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 31 Dec 2021 15:14:09 +1300

> It's either a significant security threat, or it's not. I think Router Alert should be deprecated, in those RFCs, or what's the point? (I was actually looking forward to this simplification.)

MLDv2 requires Router Alert and the real world requires MLDv2. So no, you can't abolish Router Alert without universally deploying a replacement for MLDv2. That's impracticable.

    Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 31 Dec 2021 15:53:00 +1300

> not seem to accomplish that.

A BCP could say that, just as well as a Standards Track document.
I didn't intend to remove the deprecation text, but to add an actual
update to Node Requirements.

It seems to me that the message would then be more clear and would be
carried forward in future revisions of Node Requirements. At the
moment the draft is compatible with the present Node Requirements,
but there's nothing in Node Requirements to cause a product manager
to be aware of the deprecation.

This would be a fine case for applying the See Also tag proposed
in draft-kuehlewind-update-tag. The document would end up with

Amends: 8504
See Also: 2711

Regards
    Brian