Subject: question on ICMP error packets, RFC 4443, 2.4 e)

From: Nicolas Ojeda Bar <[email-masked]>
Date: Sun, 19 Oct 2014 22:14:08 +0100

(apologies if you receive two copies of this message)

Hello,

In RFC 4443, 2.4 e.1) it says that ICMP6 errors should not be generated in
response to other ICMP errors. And in 2.4. e.3) it says that one should
generate an ICMP6 error in response to a packet with multicast destination
that has a unrecognized IPv6 option with option type with highest order 2
bits 10.

My question is whether one still has to check that the message considered
e.3) is not an ICMP6 error packet before generating one in response.
Similarly for uni/anycast messages satisfying the condition of e.3).

Please excuse if I have missed something obvious.

Thank you very much!

Nicolas

---

From: Tom Taylor <[email-masked]>
Date: Sun, 19 Oct 2014 18:53:39 -0400

The basic principle is that you never answer an error with an error, or 
you could generate an infinite loop.

Tom Taylor

On 19/10/2014 5:14 PM, Nicolas Ojeda Bar wrote:
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>

---

From: Fernando Gont <[email-masked]>
Date: Mon, 20 Oct 2014 15:23:35 -0200

Hi, Tom,

> you could generate an infinite loop.

Agreed. That said, I recall a system generating ICMPv6 unreachables in
response to some ICMPv6 error messages (I guess the router in question
just didn't bother to check the message type, and sent the error message
rightaway).

However, at least in theory, ICMPv6 error could use IPv6 EHs.. at which
point the obvious question arises "Can we really require routers to
figure out what's the ICMP message type?"

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: Simon Perreault <[email-masked]>
Date: Tue, 21 Oct 2014 08:36:05 -0600

> figure out what's the ICMP message type?"

Sending an error is never actually required, to allow for things like ICMP
rate limiting. My interpretation is that if a router doesn't have the
resources necessary to figure out if it is ok to send an error, then the
sensible thing to do is assume that it's not ok, and send nothing.

Simon

---

From: Stig Venaas <[email-masked]>
Date: Tue, 28 Oct 2014 10:49:27 -0700

Hi

> you could generate an infinite loop.

You are supposed to send ICMP6 errors in response to some multicast
packets though. E.g. packet too big.

Stig