Re: [secdir] secdir review of draft-ietf-softwire-lw4over6-11

<> Mon, 27 October 2014 06:50 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id F2DE11A1A39; Sun, 26 Oct 2014 23:50:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, J_CHICKENPOX_31=0.6, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id XO1ljcMpWaFJ; Sun, 26 Oct 2014 23:50:22 -0700 (PDT)
Received: from ( []) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 23FD81A89B8; Sun, 26 Oct 2014 23:50:22 -0700 (PDT)
Received: from (unknown [xx.xx.xx.4]) by (ESMTP service) with ESMTP id 5A32D22C2E8; Mon, 27 Oct 2014 07:50:20 +0100 (CET)
Received: from Exchangemail-eme2.itn.ftgroup (unknown []) by (ESMTP service) with ESMTP id 38A1623805C; Mon, 27 Oct 2014 07:50:20 +0100 (CET)
Received: from OPEXCLILM23.corporate.adroot.infra.ftgroup ([]) by OPEXCLILH03.corporate.adroot.infra.ftgroup ([]) with mapi id 14.03.0195.001; Mon, 27 Oct 2014 07:50:20 +0100
To: Samuel Weiler <>, "" <>
Thread-Topic: secdir review of draft-ietf-softwire-lw4over6-11
Thread-Index: AQHP7wYExWTftw7JLEWHpivKLsWtkpxDgqWg
Date: Mon, 27 Oct 2014 06:50:19 +0000
Message-ID: <787AE7BB302AE849A7480A190F8B93301BD386@OPEXCLILM23.corporate.adroot.infra.ftgroup>
References: <>
In-Reply-To: <>
Accept-Language: fr-FR, en-US
Content-Language: fr-FR
x-originating-ip: []
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-PMX-Version:, Antispam-Engine:, Antispam-Data: 2014.10.27.53032
Cc: "" <>, "" <>
Subject: Re: [secdir] secdir review of draft-ietf-softwire-lw4over6-11
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Directorate <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 27 Oct 2014 06:50:25 -0000

Dear Samuel,

Meany thank for the review.

Please see inline.


-----Message d'origine-----
De : Samuel Weiler [] 
Envoyé : jeudi 23 octobre 2014 23:12
À :
Cc :;
Objet : secdir review of draft-ietf-softwire-lw4over6-11

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

Does this mechanism introduce new points for a DoS attack,
e.g. forging the ICMPv6 error message (type 1, code 5) mentioned in
Section 5.1?  I would like to see a list and discussion of these or,
if appropriate, an analysis showing that none exist.

[Med] Good point. We can add this sentence: 

"lwAFTR MUST rate limit ICMPv6 error messages to defend against DoS attacks generated by an abuse user.".

It's probably worth explaining this 2119 RECOMMENDation in more 

    Unless an lwB4 is being allocated a full IPv4 address, it is
    RECOMMENDED that PSIDs containing the well-known ports (0-1023) are
    not allocated to lwB4s.

[Med] FWIW, this text was added as a response to a comment from the WG (, Saying that, I'm personally for removing this sentence from the draft. This is more deployment-specific rather than an architectural discussion. We can just remove this one and let any deployment draft discuss this point further. 

I would like to see a discussion of provisioning mechanism security.

[Med] This is out of scope of this document. Dedicated provisioning mechanism specification documents should discuss it. We can add a sentence to Section 9 to capture this.

Are there security-related factors that should drive the choice of
provisioning mechanism (the doc mentions several options...)?  Are
there configuration choices that should or must be made when using one
of thsoe for this purpose?

[Med] No IMHO.

Non-security stuff:

I'm not seeing any explicit discussion of whether (and how) a lwB4 can 
request additional port space after the initial assignment.  If that 
feature does not exist, I would like to see it explicitly acknowledged 
as a limitation with a discussion of why it is not being provided.

[Med] This is implementation-specific. This feature is supported when PCP is used for instance (draft-ietf-pcp-port-set).

Again, assuming that there is not such a mechanism: since this is the 
architecture document, I would like to see a few words on expected 
port assignment/utilization ratios.  

[Med] Discussion on address sharing ratio is deployment-specific. It has nothing to do with in an architectural document. You may find a discussion in and 

Assuming a typical case of a 
residential subscriber, it seems that lw4o6 would need to assign 
enough ports to each user to accommodate expected peak usage.  This 
pretty clearly results in fewer users accommodated on a public v4 
address than if they were sharing the port space on demand.  How much 
much v4 space does lw4o6 consume in this environment compared to 

[Med] This is deployment-specific. Please refer to 

Editorial stuff:

The next-to-last paragraph of section 1 doesn't seem to flow well with
the text around it, perhaps for lack of clarity in pronoun

    This document is an extended case, which covers address sharing for
    [RFC7040].  It is also a variant of A+P called Binding Table Mode
    (see Section 4.4 of [RFC6346]).

[Med] What about:

    "This document extends the mechanism defined in [RFC7040] by allowing address sharing. The solution in this document is also a variant of A+P called Binding Table Mode (see Section 4.4 of [RFC6346])."

And I think something is broken in the below sentence:

    The solution specified in this document allows the assignment of
    either a full or a shared IPv4 address requesting CPEs.

[Med] What about:

   "This document allows for the assignment of
    either a full IPv4 address or a shared IPv4 address to requesting CPEs."