Subject: Re: IETF IPv6 platform configuration

From: Iljitsch van Beijnum <[email-masked]>
Date: Tue, 13 Jun 2006 11:26:16 +0200

On 12-jun-2006, at 23:03, Pekka Savola wrote:

>> Is there a compelling reason to filter ICMP at all?

> IMHO, this is a valid question.

Don't bother thinking about an answer, people are going to do it anyway.

An important problem with all kinds of filtering in IPv6 is that most  
filters don't support the "protocol chain" concept so if you have a  
fragment header or an AH header or some such between the IPv6 header  
and the payload protocol, you're out of luck and the payload protocol  
isn't recognized.

> There also happens to be a document, draft-ietf-v6ops-icmpv6- 
> filtering-recs-00.txt that discusses this very issue.  It might be  
> interesting to have folks read that and provide feedback to v6ops  
> list ([email-masked]) if they think there's something amiss  
> with it.

Please use "hop limit" rather than "hop count" as the former is the  
official name of the field.

And do we really need 34 pages just to say "if you're so paranoid  
that you want to filter ICMPv6, at least have the sense to let these  
ones through"?

We live in an age of information overload, conciseness is a virtue!

---

From: Pekka Savola <[email-masked]>
Date: Tue, 13 Jun 2006 13:22:08 +0300 (EEST)

On Tue, 13 Jun 2006, Iljitsch van Beijnum wrote:
> And do we really need 34 pages just to say "if you're so paranoid that you 
> want to filter ICMPv6, at least have the sense to let these ones through"?
>

While I agree that some parts of the doc could possibly be a bit 
shorter, I still think the document is about the right length.  The 
main meat is about 15 pages.  The question at this point is, I guess, 
whether all the appendices are useful enough.  At least the text in 
the main body is required when a reader starts to think "but, I really 
want to block [foo].  Why shouldn't I just go ahead and do so?"

That said, maybe it wouldn't hurt to put some conclusions to the 
abstract, introduction, a new section or call them out more explicitly 
from the existing text.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Elwyn Davies <[email-masked]>
Date: Tue, 13 Jun 2006 14:11:27 +0100

> want to block [foo].  Why shouldn't I just go ahead and do so?"
The actual recommendations run to 7 pages and the example script 
(Appendix B) is about the same length - given the two cases and the 
number of different messages I don't think you can get much more concise 
if you want a bit of reasoning and a decent layout.

Appendix A provides the detailed analysis: discarding this would be 
possible, but the result is people have to reinvent the logic sometime 
in the future.
> abstract, introduction, a new section or call them out more explicitly 
I can't see a very simple way to add a *brief* conclusion to the 
abstract/intro.  What I have done is to add a paragraph pointing 
directly to the recommendations for those who think they know about (or 
don't care about) ICMPv6 and what security attacks might eventuate.

/Elwyn