Subject: (ngtrans) draft-savola-ngtrans-6to4-security-00.txt

From: [email-masked]
Date: Thu, 25 Apr 2002 10:11:05 -0400 (EDT)

Pekka,

here are some questions that I had while reading
draft-savola-ngtrans-6to4-security-00.txt- could you please clarify:

- Section 3.1, Page 6:
  I'm guessing that "normal IPv6 routing" in the lines below  means 
  route into the native ipv6 cloud? 

   328                - if packets are received from 6to4 addresses through
   329                  tunneling, decapsulate them and forwards them on using
   330                  normal IPv6 routing

  In which case this should probably be "if packets are received
  _to_native_v6_addresses_ through tunneling, decapsulate them..."

- Section 3.2, Page 7:
  The lines below seem to assume that the ip6_src is a 6to4 prefix,
  which may not be the case at all (esp. for relay routers)

   351           - receive traffic from 6to4 Routers where the IPv4 tunnel
   352             source address does not match the 6to4 prefix

  Also, throughout  the draft, there's an emphasis on "src MUST match
  src_v4" which seems to be too restrictive. Consider, for example, a
  6to4 site with two 6to4 routers, 2002:0800:0001::1 and 2002:0800:0001::2 
  If 2002:0800:0001::2 wants to send a packet to destination Y, it may
  want to set the ipv4 source address to some (one of its own) 
  interface address other than 8.0.0.1. But the "src MUST match src_v4" 
  prevents that.

- Is there some requirement that relay routers cannot be border 6to4 
  routers? Why prohibit the following (taken from Section 3.2, Page 7)?
   356       o 6to4 Router
   357           - send traffic to other 6to4 domains through 6to4 Relay Router
   358             or via some third party 6to4 Router
   359           - receive traffic from other 6to4 domains via a 6to4 Relay
   360             Router

- Appendix A.3: the DoS Reflector attacks described for Relay Routers
  could just as easily happen to a vanilla ipv6 router, if the ip6_src
  is forged, the ip6_dst is set to a victim's address, and the link-layer
  source and dest are then crafted into the packet- couldn't they?

Thanks 
Sowmini