Subject: RE: New "IP Version 6 Addressing Architecture" draft

From: Hideaki YOSHIFUJI <[email-masked]>
Date: Sat, 22 Jul 2000 10:10:21 +0900

In article <[email-masked]> (at Fri, 21 Jul 2000 17:03:19 -0700), Brian Zill <[email-masked]> says:

> I am unwilling to give up SIIT.  Changing the architecture to forbid
> IPv4-mapped addresses on the wire is unacceptable in my opinion.

Me too.

> If an IPv4 packet arrived at your machine with a source address of
> 127.0.0.1, what would your kernel do?  Now if an IPv6 packet arrives at your
> machine with a source address of ::ffff:127.0.0.1, what does your kernel do?
> If it does the same thing in both cases, why should user-land care how it
> got there?  If it doesn't do the same thing, why not?

Same thing.  You are right!

> > they can let us relay malicious packets by abusing
> > normal IPv6 routers, auto-tunnel capable IPv6
> > routers, and 6to4 relay routers.  it will be much
> > harder to track than normal IP packets we are seeing.
> 
> These are all tunnelling issues.  Nobody is suggesting getting rid of
> tunnels to fix them - they're suggesting appropriate security checks.  I ask
> again, why is adding checks to protect against v4-mapped address misuse any
> different?

Agreed.

> > SIIT requires the dual use of IPv4 mapped address 
> > (native-ipv4-mapped and RFC2553-inbound).  this is
> > a feature of SIIT, not the other documents.
> 
> No, SIIT doesn't require user-level programs to receive IPv4 packets on
> AF_INET6 socekts.  It only requires that IPv6 packets (with v4-mapped
> addresses) are received on AF_INET6 sockets.  Machines living on the v6 side
> of the translator only need to speak v6!

Yes, SIIT is for IPv6 node that is not IPv4 capable.
And you can drop packet that have encapsulated ipv4 source
address belongs to local subnet (a.b.c.d/n) from outside:

   subnet      +----------+ outside (IPv6, IPv4)
---------------| SIIT Box |----------------------
 (a.b.c.d/n)   +----------+

And, leaf nodes should drops packets from ::ffff:127.0.0.0/104 from subnet
as we want to drop 127.0.0.0/8 on ipv4 nodes:

+-----------+            subnet
| ipv6 node |---------------------------------
+-----------+ (IPv6 capable, don't care IPv4)

Itojun, issues/examples you raised are not problems
(at RFC2553 or addressing-architecture level).
You should raise new examples again to convince us.

-- 
Hideaki YOSHIFUJI @ USAGI Project  <[email-masked]>
Web Page: http://www.ecei.tohoku.ac.jp/%7Eyoshfuji/
PGP5i FP: F731 6599 5EB2 BBA7 1515  1323 1806 A96F 5700 6B25