Subject: Re: (ngtrans) draft-ietf-ngtrans-mech-04.txt: security issue

From: [email-masked]
Date: Wed, 15 Mar 2000 02:24:45 +0900

>> >> 	IPv4 src/dst address in outer IPv4 header must match the
>> >> 	IPv6 (in IPv4 compatible address) src/dst address in 
>> >> inner IPv6 header.
>Am I understanding correctly that receivers are now supposed to apply
>this rule?  If so how does an implementation tell the difference between
>a datagram that was tunnelled using automatic tunnelling and a datagram
>that was tunnelled from the source using a unidirectional configured
>tunnel?  This filtering rule will cause datagrams of the second form
>to be discarded.

	In mech-04 configured tunnels and auto tunnels are separately
	talked (separate section).  My suggestion is only for auto tunnels.

itojun

---

From: Tim Hartrick <[email-masked]>
Date: Tue, 14 Mar 2000 09:17:49 -0800 (PST)

Or is this rule more accurately written as:

	If the source and/or destination address of the IPv6 datagram is an
IPv4 compatible IPv6 address then the source and/or destination address of
the encapsulating IPv4 header must be equivalent to the low order 32 bits
of the source and/or destination of the IPv6 datagram.

Tim Hartrick
Mentat Inc.