Subject: LL6, LL8, LL10, LL11, LL16, LL17, LL19

From: Aidan Williams <[email-masked]>
Date: Mon, 17 Feb 2003 16:39:35 +1100

LL6  Add security considerations note regarding wireless LANs
===  Reject suggested text.

      Section 2.8 is about IP forwarding, but the proposed text talks
      about link-layer and physical security (which are good things to
      talk about, just not here).

      Alternative suggestion: remove everything in Section 2.8 except
      for the first paragraph.

      The "Security Considerations" section already says:

         implementers of devices supporting the Internet Protocol must
	not assume that a customer's local network is free from
	security risks.

LL8  Is additional Routing Considerations text needed?
===  Accept. (ie No Change)

      I would support Ted Lemon's suggestion for this as well:
      http://www.merit.edu/mail.archives/zeroconf/msg01861.html

LL10 Add warnings to applicability statement
==== Accept, with changes.

      I support Philip Nye's text, as munged and quoted by Erik:
      http://www.merit.edu/mail.archives/zeroconf/msg01828.html

      FWIW, I'm not particularly keen on the "profound" wording of the
      first suggested paragraph.  On an isolated network, with one
      subnet, many of those applications are fundamentally going to
      work just fine, in the face of all the assumptions that
      apparently no longer hold.

LL11 Add security consideration for the threat where an attacker
==== forces address reconfiguration
      Accept.  As suggested on the issues page.

      I do not support the text about sending RSTs, e.g. the text:
        http://www.merit.edu/mail.archives/zeroconf/msg01830.html
      Local TCP connection hijacking is possible with or without
      IPv4LL, and the suggested countermeasure adds little.

LL16 Separate normative and informative references.
==== Accept.  Surely the new editor can figure it out.

LL17 Hosts with configured addresses MUST ARP for v4 LL addresses
==== Accept with changes.

      Modification suggested by Christian Huitema seems good:
      http://www.merit.edu/mail.archives/zeroconf/msg01842.html

LL19 Do not use v4LL source address to non-v4LL destinations
==== Reject.

      We had what appeared to be consensus that hosts with non-v4LL
      addresses should be allowed to communicate with hosts that had
      only IPv4-LL addresses.  I don't see any new information which
      would change my mind on that score.