Subject: (ngtrans) draft-bereski-ngtrans-nd-dstm-00.txt

From: Alain Durand <[email-masked]>
Date: Thu, 06 Dec 2001 00:05:20 -0800

Hi,

There is something I do really understand in 
draft-bereski-ngtrans-nd-dstm-00.txt
In the case where the communication is initiated by the external IPv4 host,
how will Y4/Y6 notify X6 of the new address?
Would X6 had to set up the tunnel with Y4/Y6 before and listen for the 
newly defined
RA on that tunnel?

Also, about the security issues, if a malicious IPv4 hosts happen to
know a certain number of the names of hosts in a DSTM domain,
it could easily create a DOS attack on exactly the same number of IPv4
addresses from the DSTM domain IPv4 address pool.
If the size of this pool is smaller or equal to that number, the DSTM domain
is unreachable. This is the very reason why we removed this feature
from the basic DSTM spec.

	- Alain.

---

From: Gilles Diribarne <[email-masked]>
Date: Thu, 06 Dec 2001 18:01:04 +0100

Hi Alain,

 > Would X6 had to set up the tunnel with Y4/Y6 before and listen for the

Z4 host wants to communicate with X6. It sends a DNS request A type
The DNS has no A record for the X6 node. It starts the process:

- The DNS sends a RS message to the Y4/Y6 with the X6 IP source address, 
as the X6 node would have done itself in the reverse situation.
- Y4/Y6 sends a RA to X6 (considering it has received a RS from X6).
- When the X6 node receives this packet, it binds its address
and so on...

There is no tunnel setup for X6 to Y4/Y6. Packet RA/RS are automatically 
encapsulated in V6 packet to overpass the link local scope of RA/RS message.

 > from the basic DSTM spec.

This point has been mentionned in "4. Security issues".
The problem is similar for NAT/PT and the address pool.
So, solution on that particular problem solved in NAT/PT could be reused
here.

DSTM gateway may limit the number of association for any V4 host. The 
DOS attack must come from several V4 nodes to be successful.

At least, the DSTM gateway can reserve part of address pool for outgoing 
V6 connections.

We are also looking at solutions, such as TCP syn DOS (randomly cancel a 
previously established connection).

Damien Galand,
Gilles Diribarne,
Philippe Bereski

---

From: Alain Durand <[email-masked]>
Date: Thu, 06 Dec 2001 10:51:17 -0800

>- When the X6 node receives this packet, it binds its address

This is this last point I do not understand...
draft-bereski-ngtrans-nd-dstm-00.txt says that those RA are encapsulated
IPv6 in IPv6. How is X6 suppose to listen to them?

         - Alain.