(ngtrans) Security and use of SIIT and NAT-PT [IPv4 and MIPv6 Transition]

Pekka Savola <pekkas@netcore.fi> Thu, 25 October 2001 12:55 UTC

Date: Thu, 25 Oct 2001 15:52:46 +0300
From: Pekka Savola <pekkas@netcore.fi>
To: ngtrans@sunroof.eng.sun.com
cc: "'mobile-ip@sunroof.eng.sun.com'" <mobile-ip@sunroof.eng.sun.com>
Subject: (ngtrans) Security and use of SIIT and NAT-PT [IPv4 and MIPv6 Transition]
In-Reply-To: <4B6BC00CD15FD2119E5F0008C7A419A51308EDE6@eaubrnt018.epa.ericsson.se>
Message-ID: <Pine.LNX.4.33.0110251528520.19785-100000@netcore.fi>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"
Sender: owner-ngtrans@sunroof.eng.sun.com
Precedence: bulk
Reply-To: Pekka Savola <pekkas@netcore.fi>

I'll post this primary on ngtrans.  If there are further comments I think 
mobile-ip can be safely removed.

On Thu, 25 Oct 2001, Hesham Soliman (EPA) wrote:
> > Perhaps I shouldn't comment on this, but anyway...
> > 
> 	=> Why not !

Partly ideological debate, better held in ngtrans anyway :-)

> > > There is another draft you can find at:
> > > http://standards.ericsson.net/hesham/draft-ietf-ngtrans-siit-dstm-00.txt
> > > 
> > > It's a WG draft in NGTRANS but it expired and I'll
> > > resubmit it after adding some of the comments received. 
> > 
> > SIIT is regarded by many to be an abomination (redefining internal 
> > structure like mapped-addresses) from security point-of-view among others.
> > 
> > It can probably solve some problems efficiently though, or else it 
> > wouldn't have been introduced. :-)
> > 
> 	=> Well SIIT is a translation algorithm, used by NAT-PT and
> 	this draft. It certainly does solve problems, like translating
> 	packets.

There is a significant difference with SIIT and NAT-PT algorithm.  NAT-PT
does not use mapped addresses when signifying an IPv4 node.

Putting mapped addresses as source/destination addresses is evil; think of
(ab)using these against dual-stacked nodes. 

E.g.: IPv4 firewall would block packets from source 1.2.3.4, but the
packet gets through via IPv6 transport with src address ::ffff:1.2.3.4,
and the destination will falsely believe that it originated from IPv4
source 1.2.3.4.

This would open some new IPv6 <-> IPv4 reflector attacks, too, I believe.

> > But it should be kept in mind that it, alone, cannot be relied on to be
> > sufficient for (M)IPv4 -> (M)IPv6 transition.
> > 
> 	=> Can you elaborate a bit ? This draft is done for allowing
> 	IPv4-only nodes to communicate with IPv6-only nodes. 
> 	MIP is one aspect of this communication. 
> 	The draft doesn't say that this is the only way to do it, 
> 	although in fact, for this scenario, it is the only way I know
> 	of that allows for mobility support. 

Perhaps I didn't say it clearly; _IMO_, SIIT is not fit to be a
wide-spread translation mechanism for IPv6-only nodes.  NAT-PT seems much
better.  I tried to avoid getting MIP mixed into this.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

(ngtrans) Security and use of SIIT and NAT-PT [IP… Pekka Savola