On Tuesday, January 10, 2017 9:55 AM, Fred Templin wrote: > ... > What is being proposed in the document I submitted is the inclusion of > RIOs in Redirect messages for a *prefix* that is not on-link, as opposed > to a singleton destination. So, the same SHOULD in the paragraph above > would seem to apply also to prefix redirection the same as for ordinary > destination redirection.
Fred, I am reading the security section of your draft. I think it needs a bit more work. Currently, the RIO are only expected in router advertisements. RA are somewhat special, and there is often specific code in switches to check RA and prevent RA spoofing -- e.g., RA-Guard. Allowing the option in Redirect messages could very well bypass the RA specific checks. Doesn't that open the path for new attacks? Should you not say something about that in the security section? How about specific mitigations, such as sanity checks when processing redirect messages? -- Christian Huitema _______________________________________________ Int-area mailing list [email protected] https://www.ietf.org/mailman/listinfo/int-area
