Subject: Re: [v6ops] Last Call: <draft-ietf-v6ops-ra-guard-implementation-04.txt> (Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard)) to Best Current Practice

From: Ran Atkinson <[email-masked]>
Date: Wed, 30 May 2012 17:05:43 -0400

Fernando wrote:
> It's not a protocol change, but an operational mitigation. -- for
> instance, there is no change in the way the sending router or the
> receiving hosts process RAs.

Nonsense.  

Rule 4 mandates changes to whether certain IPv6 packets get forwarded,
which is a major change to the IPv6 protocol specifications.

Rule 4 is both a protocol change and (misguided) operational mitigation.  
Rule 4 is mandatory according to this document and will cause certain 
perfectly valid IPv6 packets to be dropped instead of forwarded.  The
rule damages IPv6 and impairs utility of IPv6 in the real world.

The comprehensive fix is to update the hosts as Joel Halpern and Ron Bonica
outlined earlier today.  I don't think that change would be controversial,
so likely it could proceed quickly through 6MAN.  In the meantime,
Rule 4 could be edited and cleaned up such that no valid IPv6
packets get dropped by an RA Guard.

Yours,

Ran

---

From: Fernando Gont <[email-masked]>
Date: Thu, 31 May 2012 12:19:04 -0300

> rule damages IPv6 and impairs utility of IPv6 in the real world.

I have asked (some of) this already, but will retry:

1) How large do you expect packets employing CALIPSO become? (mostly
curious here)

2) Do you find it acceptable to have your (mtu-zized) traffic be 50%
overhead (at the very least)?
(FWIW, I'm obviously implying that the IPv6 header chain is spanning
multiple fragments, and hence at least the first fragment is 100%
headers -- and not necessarily as a result of employing CALIPSO).

3) Don't you find packets breaking stateless translators "impairing the
utility of IPv6 in the real world"?
(FWIW, packets with an IPv6 header chain spanning multiple fragments do)

4) Do you expect there will not be stateless filtering in IPv6?

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492