Subject: 6MAN WG Last Call: draft-shore-icmp-aup

From: Ole Troan <[email-masked]>
Date: Fri, 13 Dec 2013 11:41:05 +0100

All,

Our AD has requested that the 6MAN working group review this document. This is part of our chartered work
to review documents produced outside of 6MAN, that may extend or change the IPv6 protocol.

This message starts a one week 6MAN Working Group Last Call for a review of:

	Title           : An Acceptable Use Policy for New ICMP Types and Codes
	Author(s)   : M. Shore, C. Pignataro
	Filename   : draft-shore-icmp-aup-07
	Pages        : 9
	Date          : 2013-12-05

    http://tools.ietf.org/html/draft-shore-icmp-aup-07

as a BCP.  Substantive comments and statements of support for advancing this document should be directed to the mailing list.
Editorial suggestions can be sent to the authors.  This last call will end on December 20, 2013.

As with our regular working group last calls, the chairs would like to solicit one or two people in the working group
to do a detailed review of the document.

Regards,

Bob Hinden & Ole Trøan

---

From: 神明達哉 <[email-masked]>
Date: Fri, 13 Dec 2013 13:06:31 -0800

At Fri, 13 Dec 2013 11:41:05 +0100,

> to review documents produced outside of 6MAN, that may extend or change the IPv6 protocol.

[...]

> to do a detailed review of the document.

I've read the draft.  I don't know if this meets the requirement for a
"detailed review", but here are my comments anyway:

- Overall, I didn't see a critical issue in it.  It's also pretty
  clear and easy to understand.  I can't say anything about the
  importance of the draft, though, simply because I don't know much
  about the background concerns.  I also don't know if the proposed
  guideline and categorization are the "best current practice", but I
  don't have a strong opinion on these anyway.

- In Section 2, I think it'd be more helpful if it shows some examples
  of "other uses":

   Normally, other uses are not advisable.

  Now that I've read the entire draft (Section 2.1.1 and Section 4 in
  particular), I guess the example could be "used as a routing or
  network management protocol".

- The subsequent sentence placed in the same paragraph was confusing
  to me:

   [...]  While ICMP's role is not to
   be a general-purpose network management protocol, it does have a role
   to play in conveying dynamic information about a network.

  in that I couldn't understand the relationship between the first and
  second sentences.  Maybe the example mentioning "network management
  protocol" as suggested in the previous bullet will help clarify
  that.  For example:

   Normally, other uses such as implementing a routing or
   general-purpose network management protocol are not advisable.
   However, it does have a role to play in conveying dynamic
   information about a network, which would belong to category 2
   above.

- In Section 2.3, it states:

   Because ICMPv6 is used for IPv6 Neighbor Discovery, deployed IPv6
   routers, IPv6-capable security gateways, and IPv6-capable firewalls
   normally support administrator configuration of how specific ICMPv6
   message types are handled.

  Is this true?  The question is actually two-fold: I'm not sure if
  it's true that "IPv6-capable firewalls normally support..."
  (especially if such FWs don't have the support for ICMPv4); even if
  this is true, I'm not sure if that's because ICMPv6 is used for ND.
  ND messages are only used in a single link, so at least for
  firewalls from one link to another, ND should still work even if
  they filter any ICMPv6 packets without any configuration knob.  If
  these are really true and the fact, then that's fine.  It just
  didn't seem to me likely.

- A very minor point: I think "sections" should be "section":

   In following sections we provide some background on the differences
   between control and management traffic.
   (last paragraph of Section 3)

  because, if I understand it correctly, this "sections" specifically
  means Section 4 and only that section (and it doesn't have any
  subsections).

--
JINMEI, Tatuya

---

From: Ray Hunter <[email-masked]>
Date: Sat, 14 Dec 2013 13:18:35 +0100

> to do a detailed review of the document.

I read the draft. It is pretty easy to read and straight forward.

I don't understand the underlying concerns. The motivation is not
included in the draft (I guess I'd have to go to the WG mailing list to
get that information)

Why should ICMP be limited?

Does ICMPv6 really need to be so limited if it is only used for on-link
communication using link-local addresses?

-- 
Regards,
RayH

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Sat, 28 Dec 2013 15:51:13 +0000

Hello, Jinmei,

Many thanks for your review! Please see inline.

>  don't have a strong opinion on these anyway.

Regarding the doc being clear and easy to understand -- Thanks!

Regarding the motivation -- the main goal is to have a documented basis for the IESG to decline ICMP uses when other protocols should be used and ICMP is inappropriate. For example, using ICMP as a substitute of SNMP, or for full-fledged industrial control protocol or full-fledged routing protocol. 

>  network management protocol".

Exactly, as above, and as you point out, those are some of the not advisable uses. We debated and chose not to include examples of other uses, to further future proof the document and not be overly restrictive. That said, I like what you propose below.

>   information about a network, which would belong to category 2

I think this is better than what we have now. Thanks for the proposal.

>  didn't seem to me likely.

You will find that the tone of this section is not that of a definitive absolute statement. Chances (and hopes) are that future of configuration features will be implemented in v6 (and ICMPv6) before ICMPv4, if at all on v4.

>  means Section 4 and only that section (and it doesn't have any

Yes, ack. Since singular, we will also have to add a "the", I will make this change.

Thanks again for the review.

-- Carlos.

> --
> JINMEI, Tatuya
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Sat, 28 Dec 2013 16:20:10 +0000

Ray,

> I read the draft. It is pretty easy to read and straight forward.

Thanks!

> included in the draft (I guess I'd have to go to the WG mailing list to

The main motivation is to have a documented basis to decline ICMP uses when ICMP is inappropriate, for example using ICMP as a substitute to SNMP.

> Why should ICMP be limited?

The document aims at striking a balance and to have a document that is useful but not overly restrictive. The last couple of revisions have basically been polishing that balance, as the document received great feedback that improved it. The most recent from Ran Atkinson, who also highlighted the need for explicitly checking this list, in addition to making the spec more precise and less restrictive.

As for "why?" hopefully Section 3 and especially Section 4 of the document answer that.

> communication using link-local addresses?

It is not so limited -- I believe that the other recent piece of feedback on this list (and upcoming -08) will clarify even more as it makes some examples explicit.

Thanks again for the review and comments!

Carlos.

---

From: 神明達哉 <[email-masked]>
Date: Mon, 30 Dec 2013 10:46:13 -0800

At Sat, 28 Dec 2013 15:51:13 +0000,

> You will find that the tone of this section is not that of a definitive absolute statement. Chances (and hopes) are that future of configuration features will be implemented in v6 (and ICMPv6) befo…

I'm not sure if this answers my questions.  But if you are confident
that what's written in this section is accurate, I wouldn't be opposed
to it.

I've confirmed my other comments were addressed in the 08 version.

--
JINMEI, Tatuya