Subject: [v6ops] [Technical Errata Reported] RFC4890 (3985)

From: RFC Errata System <[email-masked]>
Date: Tue, 13 May 2014 17:07:50 -0700 (PDT)

The following errata report has been submitted for RFC4890,
"Recommendations for Filtering ICMPv6 Messages in Firewalls".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=4890&eid=3985

--------------------------------------
Type: Technical
Reported by: James Robertson <[email-masked]>

Section: Appendix B

Original Text
-------------
if [ "$STATE_ENABLED" -eq "1" ]
then
  # Allow incoming time exceeded code 0 messages
  # only for existing sessions
  for inner_prefix in $INNER_PREFIXES
  do
    ip6tables -A icmpv6-filter -m state -p icmpv6 \
         -d $inner_prefix \
         --state ESTABLISHED,RELATED --icmpv6-type packet-too-big \
         -j ACCEPT
  done
else
  # Allow incoming time exceeded code 0 messages
  for inner_prefix in $INNER_PREFIXES
  do
    ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \
         --icmpv6-type ttl-zero-during-transit -j ACCEPT
  done
fi

Corrected Text
--------------
if [ "$STATE_ENABLED" -eq "1" ]
then
  # Allow incoming time exceeded code 0 messages
  # only for existing sessions
  for inner_prefix in $INNER_PREFIXES
  do
    ip6tables -A icmpv6-filter -m state -p icmpv6 \
     -d $inner_prefix \
     --state ESTABLISHED,RELATED --icmpv6-type ttl-zero-during-transit \
     -j ACCEPT
  done
else
  # Allow incoming time exceeded code 0 messages
  for inner_prefix in $INNER_PREFIXES
  do
    ip6tables -A icmpv6-filter -p icmpv6 -d $inner_prefix \
         --icmpv6-type ttl-zero-during-transit -j ACCEPT
  done
fi

Notes
-----
RFC 4890 Errata ID 2706 states that icmpv6-type packet-too-big should
state icmpv6-type ttl-zero-during-transmit. This should read
ttl-zero-during-transit.

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC4890 (draft-ietf-v6ops-icmpv6-filtering-recs-03)
--------------------------------------
Title               : Recommendations for Filtering ICMPv6 Messages in Firewalls
Publication Date    : May 2007
Author(s)           : E. Davies, J. Mohacsi
Category            : INFORMATIONAL
Source              : IPv6 Operations
Area                : Operations and Management
Stream              : IETF
Verifying Party     : IESG

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Thu, 15 May 2014 03:25:34 +0000

Guys:

Do we agree with this?

---

From: joel jaeggli <[email-masked]>
Date: Wed, 14 May 2014 21:09:14 -0700

> Do we agree with this?

it's not really normative text, it's an example in an appendix.

assuming you think it's an issue  and the correction is reasonable I
would probably just hold it for a document update (seems unlikely atm
but who knows)

---

From: Elwyn Davies <[email-masked]>
Date: Thu, 15 May 2014 11:24:39 +0100

HI.

This looks correct.  I am forwarding the message to Suresh who actually
authored the script for an opinion.

Assuming that he concurs, I don't see any harm in issuing an erratum and
a very few people might actually be using the script verbatim.

There was a move afoot to make a new version (and possibly transition
this to BCP) but we haven't managed to get it together to do so yet.

Regards,
Elwyn

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Thu, 15 May 2014 14:44:57 +0000

Thanks

---

From: Suresh Krishnan <[email-masked]>
Date: Thu, 15 May 2014 10:47:56 -0400

Yes. This is a copy paste error on my part. The script probably needs to 
be rewritten to make use of more modern netfilter features like 
conntrack. I am willing to take a shot at a -bis version if Elwyn wants 
to go that way.

Thanks
Suresh

---

From: Mohacsi Janos <[email-masked]>
Date: Sun, 18 May 2014 15:17:30 +0200 (CEST)

Dear Fred and alls,
 	I looked it, and it seems to me the errata should be accepted.
 	Kinest Regards,

Janos Mohacsi
Head of HBONE+ project
Network Engineer, Director Network and Multimedia
NIIF/HUNGARNET, HUNGARY
Co-chair of Hungarian IPv6 Forum
Key 70EF9882: DEC2 C685 1ED4 C95A 145F  4300 6F64 7B00 70EF 9882

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Sun, 18 May 2014 21:05:37 +0000

I gather the erratum should be accepted. Apparently that’s your todo, Joel.

---

From: joel jaeggli <[email-masked]>
Date: Mon, 19 May 2014 07:34:55 -0700

> I gather the erratum should be accepted. Apparently that’s your todo, Joel.

Set as verified.

Thank you.
joel

---

From: Elwyn Davies <[email-masked]>
Date: Mon, 19 May 2014 15:36:57 +0100

Thanks,
Elwyn

---

From: joel jaeggli <[email-masked]>
Date: Wed, 21 May 2014 14:29:44 -0700

Thanks,

just to confirm with you guys that I verified that errata.

joel