Re: [Softwires] Ambiguity in MAP-E receiving rules

["Rajiv Asati (rajiva)" <[e-mail]>]

The updated text looks reasonable to me.

-----Original Message-----
From: Ole Troan <[e-mail]>
Date: Monday, August 5, 2013 6:16 AM
To: Tom Taylor <[e-mail]>
Cc: Softwires-wg list <[e-mail]>
Subject: Re: [Softwires] Ambiguity in MAP-E receiving rules

>>> 
>> [PTT] Is there any point to having the CPE generate logs? Who would
>>look at them -- the operator or the customer? If logging is useful on
>>the CPE, that should be reflected in our logging drafts, but if not, not.
>> 
>>> [ian] It may be useful to have the option of sending an ICMP error
>>>message
>>> for troubleshooting. What about if we have a 'should' requirement for
>>> logging the error on the CPE and a 'may' for sending an ICMP error
>>>message?
>
>RFC5969 has the following text:
>   In order to prevent spoofing of IPv6 addresses, the 6rd BR and CE
>   MUST validate the embedded IPv4 source address of the encapsulated
>   IPv6 packet with the IPv4 source address it is encapsulated by
>   according to the configured parameters of the 6rd domain.  If the two
>   source addresses do not match, the packet MUST be dropped and a
>   counter incremented to indicate that a potential spoofing attack may
>   be underway.
>
>section 8.1 already say MUST drop for packets to an IPv4 address not
>belonging to it.
>I suggest we add that for ports too:
>
>old text:
>
>   In order to prevent spoofing of IPv4 addresses, the MAP node MUST
>   validate the embedded IPv4 source address of the encapsulated IPv6
>   packet with the IPv4 source address it is encapsulated by according
>   to the parameters of the matching mapping rule.  If the two source
>   addresses do not match, the packet MUST be dropped and a counter
>   incremented to indicate that a potential spoofing attack may be
>   underway.  Additionally, a CE MUST allow forwarding of packets
>   sourced by the configured BR IPv6 address.
>
>new text:
>
>   In order to prevent spoofing of IPv4 addresses, the MAP node MUST
>   validate the embedded IPv4 source address and transport layer port of
>the encapsulated IPv6
>   packet with the IPv4 source address and transport layer port it is
>encapsulated by according
>   to the parameters of the matching mapping rule.  If the two source
>   addresses and transport layer ports do not match, the packet MUST be
>silently discard and a counter
>   incremented to indicate that a potential spoofing attack may be
>   underway.  Additionally, a CE MUST allow forwarding of packets
>   sourced by the configured BR IPv6 address.
>
>
>
>cheers,
>Ole
>_______________________________________________
>Softwires mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/softwires