IPv6 nodeinfo default behaviour

[神明達哉]

At Tue, 22 Jul 2014 10:01:50 -0700,
Loganaden Velvindron <logan at elandsys.com> wrote:

> > >  Security Considerations
> > >
> > >    This protocol has the potential of revealing information useful to a
> > >    would-be attacker.  An implementation of this protocol MUST have a
> > >    default configuration that refuses to answer queries from global-
> > >    scope [3] addresses.
> > >
> > > I suggest that we switch to 0 by default to be more RFC compliant.
> >
> > Are you referring to the value of '(V_)icmp6_nodeinfo'?
>
> I'm referring to the sysctl:
>
> net.inet6.icmp6.nodeinfo.

These two are essentially the same in this context: this sysctl is an
interface to (V_)icmp6_nodeinfo.  This variable is set to
ICMP6_NODEINFO_FQDNOK|ICMP6_NODEINFO_NODEADDROK by default,
and since ICMP6_NODEINFO_FQDNOK and ICMP6_NODEINFO_NODEADDROK are 0x1
and 0x2, respectively, the default value of the sysctl variable is 3
by default.

In your original message, you said

> > > I suggest that we switch to 0 by default to be more RFC compliant.

and I tried to point out that it didn't make sense because "to be more
RFC compliant" it doesn't have to switch to 0, it just needs to have
the ICMP6_NODEINFO_GLOBALOK flag (0x8) cleared, and the current
default meets the condition already.

Now you're changing the reason:

> I think that it's sensible to turn it to 0 by default, unless you need
> it.

Unlike being "RFC compliant", whether something is "sensible" is
usually subjective, and different people may have different opinions.
Personally, I often find "ping6 -w" quite useful for debugging
purposes, and I think limiting its use to link-local by default gives
a reasonable level of defense (and, disabling it by default would
reduce the usability pretty much).  So I'd rather prefer keeping the
current default, but, again, other people may have a different
preference.

--
JINMEI, Tatuya