Subject: RE: [mobile-ip] IPv4 and MIPv6 Transition

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Thu, 25 Oct 2001 15:53:37 +1000

Pekka, 

> Perhaps I shouldn't comment on this, but anyway...
> 
	=> Why not !

> > There is another draft you can find at:
> > http://standards.ericsson.net/hesham/draft-ietf-ngtrans-siit-dstm-00.txt
> > 
> > It's a WG draft in NGTRANS but it expired and I'll
> > resubmit it after adding some of the comments received. 
> 
> SIIT is regarded by many to be an abomination (redefining internal 
> structure like mapped-addresses) from security point-of-view among others.
> 
> It can probably solve some problems efficiently though, or else it 
> wouldn't have been introduced. :-)
> 
	=> Well SIIT is a translation algorithm, used by NAT-PT and
	this draft. It certainly does solve problems, like translating
	packets.

> But it should be kept in mind that it, alone, cannot be relied on to be
> sufficient for (M)IPv4 -> (M)IPv6 transition.
> 
	=> Can you elaborate a bit ? This draft is done for allowing
	IPv4-only nodes to communicate with IPv6-only nodes. 
	MIP is one aspect of this communication. 
	The draft doesn't say that this is the only way to do it, 
	although in fact, for this scenario, it is the only way I know
	of that allows for mobility support. 

	Hesham

---

From: Pekka Savola <[email-masked]>
Date: Thu, 25 Oct 2001 15:52:46 +0300 (EEST)

I'll post this primary on ngtrans.  If there are further comments I think 
mobile-ip can be safely removed.

> > Perhaps I shouldn't comment on this, but anyway...

Partly ideological debate, better held in ngtrans anyway :-)
 
> 	this draft. It certainly does solve problems, like translating

There is a significant difference with SIIT and NAT-PT algorithm.  NAT-PT
does not use mapped addresses when signifying an IPv4 node.

Putting mapped addresses as source/destination addresses is evil; think of
(ab)using these against dual-stacked nodes. 

E.g.: IPv4 firewall would block packets from source 1.2.3.4, but the
packet gets through via IPv6 transport with src address ::ffff:1.2.3.4,
and the destination will falsely believe that it originated from IPv4
source 1.2.3.4.

This would open some new IPv6 <-> IPv4 reflector attacks, too, I believe.
 
> 	of that allows for mobility support. 

Perhaps I didn't say it clearly; _IMO_, SIIT is not fit to be a
wide-spread translation mechanism for IPv6-only nodes.  NAT-PT seems much
better.  I tried to avoid getting MIP mixed into this.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords