Subject: [v6ops] Error in draft-ietf-v6ops-ra-guard-implementation-07

From: "C. M. Heard" <[email-masked]>
Date: Thu, 30 Jan 2014 09:14:58 -0800 (PST)

Hello,

In Section 3, bullet #3, I see:

  RATIONALE: [RFC6564] specifies a uniform format for IPv6 Extension 
  Header, thus meaning that an IPv6 node can parse an IPv6 header 
  chain even if it contains Extension Headers that are not currently 
  supported by that node.

Actually, it's NOT possible for a node to safely parse an IPv6 
header chain containing Next Header values that it does not know, 
even with the uniform TLV format for IPv6 extension headers defined 
in RFC 6564.  The reason for that is because unkown Next Header 
value could represent an upper-layer protocol rather than an 
extension header, so it's not safe to attempt to follow the header 
chain any further.

The document is now in AUTH48, so it's still possible to fix the 
problem before it becomes and RFC.

Section 2.1 of RFC 7045 does have an applicable requirement:

   Forwarding nodes MUST be configurable to allow packets containing
   unrecognised extension headers, but the default configuration MAY
   drop such packets.

It seems to me that the proper advice for an RA-Guard implementation 
is to include a configuration switch that specifies whether it 
passes or discards packets with unknown Next Header values, 
probably with a default discard.

Thoughts?

Mike Heard

---

From: Joe Touch <[email-masked]>
Date: Fri, 31 Jan 2014 09:33:26 -0800

> extension header, so it's not safe to attempt to follow the header

The header chain parsing at intermediate nodes is supposed to stop 
before the destination option headers (from the definition of 
destination options RFC2460).

If that rule were followed, there wouldn't be a problem. Or this RFC, 
AFAICT.

Joe