Subject: Re: I-D ACTION:draft-ietf-ipv6-ndproxy-04.txt

From: Pekka Savola <[email-masked]>
Date: Sun, 6 Nov 2005 05:03:11 +0200 (EET)

On Wed, 26 Oct 2005, [email-masked] wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the IP Version 6 Working Group Working Group of the IETF.
>
> 	Title		: Neighbor Discovery Proxies (ND Proxy)
> 	Author(s)	: D. Thaler, et al.
> 	Filename	: draft-ietf-ipv6-ndproxy-04.txt
> 	Pages		: 19
> 	Date		: 2005-10-26

I took a quick re-read of this on the plane, and I think it's good overall
and ready to go. There's just one rather new thing I don't understand,

   If an RA with the P bit set has arrived on a given interface
   (including the upstream interface) within the last 60 minutes,
   that interface MUST NOT be used as a proxy interface; i.e., proxy
   functionality is disabled on that interface.

.. this seems to be inviting DoS attacks, whether intentional or caused by
too smart hosts advertising e.g., 6to4 address space (even from a private
address space) from an internal host.

Wouldn't it be sufficient to just not pass RA's received from downstream
interfaces forward?

Granted the sender of the RA is just shooting itself in the foot but a
question is should we provide bandage for the wound or deny any help due
until the illegal weapon has been taken away.

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------