Brian Haberman wrote:
On Aug 1, 2005, at 2:08, Pekka Savola wrote:
<<snip>>
Specifically, I'm very concerned about its use with global addresses,
over
the Internet. This has a potential to turn into a kitchen sink
protocol,
which can be used to do query anything at all from a random node.
This is
exactly the thing that makes want to firewall administrators filter out
all ICMPv6 messages just to be sure messages like this won't be used
in the systems. I don't think we want that.
I have no objection to having a protocol like this used between
consenting
adults between link-local addresses or even global addresses if done
over a
single link -- but extending it (or providing extendibility) beyond that
seems unwise.
My suggestion how to deal with this is to:
- add that a node MUST send all non-link-local node information queries
with Hop Count 255; HC=255 MAY [or SHOULD] be used with other traffic
as well; and
- a node MUST, unless explicitly configured otherwise, discard any node
information queries w/ non-link-local queries which don't have
HC=255.
This only breaks backward compat for node information queries sent w/
global
addresses, over one hop away. I think we could live with that. It
should
provide a sufficiently simple security model for ensuring NIQ's won't be
used inappropriately.
I would like to solicit opinions from the working group on the
suggestions
above. Specifically, the proposal would render existing implementations
non-conformant to the spec. The primary goal of this work has been to
document what the existing code bases support, so I will not make this
change unless I see a true consensus to do so.
Since the capabilities that use multicast addresses are restricted to
link local scope addresses, it seems sensible to be consistent and make
it so that the protocol can only be used for link local queries in all
cases. I support this change.
Regards,
Elwyn
Please provide comments by Sept. 28, 2005.
Regards,
Brian
--------------------------------------------------------------------
IETF IPv6 working group mailing list
ipv6@ietf.org
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------
