Subject: (IPng 7016) RE: Question about redirect function

From: Richard Draves <[email-masked]>
Date: Wed, 6 Jan 1999 13:20:49 -0800

> According to the neighbor discovery specification, in order 
> for a redirect
> to be valid, the source address must be the same as the 
> current first-hop
> router for the ICMP destination.  Does this mean that a host 
> must have a
> destination cache entry before it will accept a redirect for that 
> destination?  If not, what happens when a host has more than 
> one router on
> its default router list - will it accept redirects from any 
> of them for a
> destination it has not communicated with previously?

This is what I implemented after reading the spec:

- if the host receiving the Redirect has a destination cache entry for the
ICMP Destination address, then check that the source of the Redirect is the
next-hop neighbor specified in the destination cache entry. Ignore the
redirect if this check fails.

- if the host receiving the Redirect does not have a destination cache
entry, then create one (the spec says SHOULD). No sanity check on the source
of the Redirect.

In the latter case, I suppose it would be a good thing to sanity-check the
source address, although it's not possible to do it perfectly. Eg valid
Redirects would sometimes be rejected.

For example, suppose H is a host sending to a destination D. A is a default
router. A sends a redirect telling H to send that traffic to router B. B is
not advertising itself as a default router. Later, B sends a redirect
telling H to send the traffic to router C. Just before receiving the second
redirect, H frees its destination cache entry for D. If H tries to
sanity-check the source address of this second redirect, it will look bogus
because H doesn't know about B anymore.

Rich
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------