Re: [Int-dir] INT Directorate - Seeking Directorate reviews

[<[e-mail]>]

Dear Bernie, Ralf, all,

Thank you for the review.

A misbehaving CPE can indeed vary the source IPv6 address it uses to send its IPv4-in-IPv6 packets to the DS-Lite AFTR. If the AFTR maintains state for each new softwire (from the same B4), then varying the source IPv6 address can be a source of DoS attack that may exhaust the AFTR resources.

A first mitigation to this attack vector is to limit the number of softwire per B4 (already recorded in the draft). This countermeasure should be complemented with rate limiting softwires with new source IPv6 from the same CPE.

A new version that includes changes to address your comment is available online:

URL:            https://www.ietf.org/internet-drafts/draft-vinapamula-softwire-dslite-prefix-binding-06.txt 
Status:         https://datatracker.ietf.org/doc/draft-vinapamula-softwire-dslite-prefix-binding/ 
Htmlized:       https://tools.ietf.org/html/draft-vinapamula-softwire-dslite-prefix-binding-06 
Diff:           https://www.ietf.org/rfcdiff?url2=draft-vinapamula-softwire-dslite-prefix-binding-06 

Cheers,
Med

> -----Message d'origine-----
> De : Bernie Volz (volz) [mailto:[e-mail]]
> Envoyé : lundi 29 juin 2015 16:51
> À : Ralf Weber; [e-mail]; draft-vinapamula-softwire-dslite-prefix-
> [e-mail]
> Cc : [e-mail]; [e-mail]; Christopher
> LILJENSTOLPE ([e-mail])
> Objet : RE: INT Directorate - Seeking Directorate reviews
> 
> Thanks Ralf.
> 
> Authors, please see below and note:
> 
> "Ralf was an assigned INT directorate reviewer for draft-vinapamula-
> softwire-dslite-prefix-binding-05. These comments were written primarily
> for the benefit of the Internet Area Directors. Document editors and
> shepherd(s) should treat these comments just like they would treat
> comments from any other IETF contributors and resolve them along with any
> other Last Call comments that have been received. For more details on the
> INT Directorate, see http://www.ietf.org/iesg/directorate.html."
> 
> - Bernie
> 
> -----Original Message-----
> From: Ralf Weber [mailto:[e-mail]]
> Sent: Monday, June 29, 2015 10:27 AM
> To: Bernie Volz (volz)
> Cc: [e-mail]; [e-mail]; Christopher
> LILJENSTOLPE ([e-mail])
> Subject: Re: INT Directorate - Seeking Directorate reviews
> 
> Moin!
> 
> On 23 Jun 2015, at 4:15, Bernie Volz (volz) wrote:
> 
> > Hi Ralf and Jean:
> >
> > Hopefully you guys can do the review for
> > https://datatracker.ietf.org/doc/draft-vinapamula-softwire-dslite-pref
> > ix-binding
> > as requested by Terry.
> Here we go:
> 
> I've read the draft and am good with it. There is one thing that might be
> added to it or it could also be that I not understood the protection
> mechanism.
> 
> As per recommendations there now is one Tunnel (default value) per /56 or
> defined prefix instead of a /128. Now if someone from the same /56
> connects the CPE tunnel endpoint is switched if another session is
> initiated. Now could that not be an DOS attack vector on the gateway, as
> an attacker can use all of the prefix to constantly generate new tunnel
> endpoints causing the gateway to migrate the traffic to the new endpoint.
> Should we not point that out and maybe recommend some rate limiting on
> tunnel connections?
> 
> So long
> -Ralf
> ---
> Ralf Weber
> Principal Architect, Special Projects
> office: [phone]
> mobile: [phone]
> us: [phone]
> Nominum
> www.nominum.com
> [e-mail]