Subject: Re: (ngtrans) 6to4 v4/v6 src/dst security checks

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Thu, 14 Jun 2001 22:13:25 +0900

>>But depending on the implementation, security checks applied to compatible
>>and 6to4 tunneling methods might vary a lot, and as such autotunneling was
>>out of the scope of "6to4" security issues consideration.
>	that is what I mentioned in abuse draft.  implementations/operators
>	must be *very* careful considering attacks using holes due to
>	complicated configuration with multiple transition technologies.

	btw, for the receiving (6to4 relay) side, the checks we need to run is
	the same - as i have noted, configurations using auto tunnel emits
	exactly the same packet as 6to4 configuration, so for your scenario,
	for the receiving side the situations is 100% equivalent.

itojun

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 14 Jun 2001 16:54:28 -0500

In answer to the original question: I think the consistency check could be applied
to both source and destination 6to4 addresses, but the source check is more
important. If you are a relay and you have received the packet, what do you
care if its 6to4 destination is not you? It's the source that you need to
validate. The source check is not that the IPV4ADDR equals the IPv4 address
of the sending router; it's that it matches the IPv4 subnet mask that the
sending router supports (i.e. it's essentially the same check as an IPv4
ingress spoof filter).

One thing seems sure: the detection of spoofed 6to4 packets cannot be stronger
than the detection of spoofed IPv4 packets. 

  Brian