Subject: RE: (ngtrans) draft-ietf-ngtrans-mech-04.txt: security issue

From: Richard Draves <[email-masked]>
Date: Tue, 14 Mar 2000 08:35:46 -0800

> 	IPv4 src/dst address in outer IPv4 header must match the
> 	IPv6 (in IPv4 compatible address) src/dst address in 
> inner IPv6 header.

You have to be careful with these kinds of checks, they prevent some
scenarios like forwarding and proxying.

We don't have any similar checks for link-layers like ethernet. (eg checking
that v6 source address resolves to the ethernet mac address in your ND
cache.)

Rich

---

From: [email-masked]
Date: Wed, 15 Mar 2000 01:42:31 +0900

>that v6 source address resolves to the ethernet mac address in your ND

	actually, with mech-04 we no longer transmit packets with
	IPv4 compatible address in IPv6 destination field in native form.
	(RFC1933 allows it in section 4.4, sender rule 2.1 and 2.2.2)
	I just suggested more clarification.  Please see the original
	email from me for gory details.

itojun

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 14 Mar 2000 16:30:12 -0600

> scenarios like forwarding and proxying.

The analagous check certainly doesn't apply in the case of a 
6to4 relay router receiving a 6to4 packet.

Surely there will be equivalent cases for IPv4-compatible addresses,
in which the next IPv6 hop for an encapsulated packet is not the 
final IPv6 destination? The checks must be configurable 'off' for
such cases.

   Brian