Jonathan Trostle: (1) there's no mention (from my quick read of the
spec.) regarding whether the host checks that the router advertisement
(and other NDP message) prefixes are contained in the router
certificate prefixes or ranges. If not, what action does the host
take?  Suggestion: if not, the host MUST find a new router.

-------

James Kempf: I think the first is just an editorial oversight.

-------

Jari Arkko: I agree. I modified the draft as follows to reflect
this:

http://www.arkko.com/publications/send/issues/issue43diff.html

This change relates to the reception of a PI within an RA. Question:
what other situations require this check? Redirect?

-------

James Kempf: Yes, Redirect requires it as well.

-------

Jari Arkko: Hmm... does this always apply? What if R1 (who has a cert
only for P1) sends a redirect regarding P2, and there's some
other router R2 thas has a cert for P2.


-------

James Kempf: Wouldn't H need to have a cert for R2 that listed the
prefixes before executing the Redirect?

I suppose one could argue that since R1 is trusted, H should trust it's
recommendation of R2, but this gets into the issue of transitivity, which is
a little tricky. 2461 actually does not require H to send a Router
Solicitation to R2, so the base spec has the issue of trust transitivity in
it.

-------

Jari Arkko: Lets think about this again. What is a redirect, really?
Its not a declaration of the advertised prefixes of a router. Its a
declaration that you should a given destination is behind another
router. So in this case the Redirect Destination Address may have
nothing to do with the prefixes assigned to the router. Clearly, we
are not certifying routing tables in SEND... Also, the Target Address
field is the link-local address of the better router, so this address
can not be compared to the certificate ranges either.

So one could perhaps make the conclusion that Redirects do not
need to be checked for consistency to the cert address ranges.

However, there is one complication: the usage of Redirect to
announce that the destination is really on-link. In this case
Target Address equals Destination Address. It seems weird that
a certified router (prefix = P) could not advertise a prefix Q
(P != Q) but could send a Redirects to everyone who wishes to
send packets to Q. And tell them that Q is really on link.

So this leads me to believe that some new text is needed for
the Redirect case. See for yourselves:

  http://www.arkko.com/publications/send/issues/issue43diff.html

Am I missing something, or is this everything?

-------

James Kempf: This looks OK. Rereading 2461 more carefully, I now see
that, as you state, the Redirect only applies to a particular
destination address, and not for changing the default router. So, I
agree that there isn't a need for prefix checking, except when
informing the node that a particular prefix is on link.

The proposed text looks fine.

-------