David, What is UHL?
Then please see in line below between <hs> and </hs> -----Original Message----- From: MILES DAVID [mailto:[EMAIL PROTECTED] Sent: Sunday, July 13, 2008 11:15 PM To: [email protected]; Hemant Singh (shemant); [EMAIL PROTECTED]; Wes Beebee (wbeebee) Subject: RE: 6MAN WG Last Call:draft-ietf-6man-ipv6-subnet-model-00.txt Wes, There are implementations that update their routing table on the receipt of a Neighbour Advertisement which we should consider. One example is the code developed in the KAME project, which can be found in many BSD-based distros. On receipt of a valid NS, the neighbour cache is updated with a stale entry and if a route does not exist for the destination a host route is created (with flags UHL). This behaviour makes sense if we consider the old on-link assumption - but it opens the security concern I expressed in v6ops. It is quite possible for an on-link node to create route entries in that may affect other links (say the target of this were an ISP router). I do not think this behaviour is desirable in a router. I would prefer to avoid behaviours that create bogus entries. It seems that we defiantly need clarification around correct node behaviour, and if we are clarifying (to be explicit that the receipt of a ND has no affect on forwarding) then should we go so far as to avoid the bogus entry? For interest; in the KAME example will drop a received NA when the target-address is not in its Neighbour Cache (the NA is discarded). <hs> This behavior by KAME is correct. See text snipped from section 7.2.5 that mentions this behavior reported by you for KAME. [When a valid Neighbor Advertisement is received (either solicited or unsolicited), the Neighbor Cache is searched for the target's entry. If no entry exists, the advertisement SHOULD be silently discarded.] </hs> Hemant -David >>> Sorry to reopen this, but do you think that the following clarification could be added to the IPv6 Subnet Models draft to address bullets three and four of the on-link definition in the Terminology section of RFC 4861: "Since only the Neighbor Cache is updated with the source address of a received ND packet or the target of an NA packet, and the Destination Cache and Prefix List are not updated, an ND packet cannot indicate that a destination is on-link in the absence of corresponding on-link prefix information." What does the WG think? - Wes ***** -------------------------------------------------------------------- IETF IPv6 working group mailing list [email protected] Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6 --------------------------------------------------------------------
