Subject: Re: [Softwires] Ambiguity in MAP-E receiving rules

From: Ole Troan <[email-masked]>
Date: Mon, 5 Aug 2013 12:16:56 +0200

>> 
> [PTT] Is there any point to having the CPE generate logs? Who would look at them -- the operator or the customer? If logging is useful on the CPE, that should be reflected in our logging drafts, but if not, not.
> 
>> [ian] It may be useful to have the option of sending an ICMP error message
>> for troubleshooting. What about if we have a 'should' requirement for
>> logging the error on the CPE and a 'may' for sending an ICMP error message?

RFC5969 has the following text:
   In order to prevent spoofing of IPv6 addresses, the 6rd BR and CE
   MUST validate the embedded IPv4 source address of the encapsulated
   IPv6 packet with the IPv4 source address it is encapsulated by
   according to the configured parameters of the 6rd domain.  If the two
   source addresses do not match, the packet MUST be dropped and a
   counter incremented to indicate that a potential spoofing attack may
   be underway.

section 8.1 already say MUST drop for packets to an IPv4 address not belonging to it.
I suggest we add that for ports too:

old text:

   In order to prevent spoofing of IPv4 addresses, the MAP node MUST
   validate the embedded IPv4 source address of the encapsulated IPv6
   packet with the IPv4 source address it is encapsulated by according
   to the parameters of the matching mapping rule.  If the two source
   addresses do not match, the packet MUST be dropped and a counter
   incremented to indicate that a potential spoofing attack may be
   underway.  Additionally, a CE MUST allow forwarding of packets
   sourced by the configured BR IPv6 address.

new text:

   In order to prevent spoofing of IPv4 addresses, the MAP node MUST
   validate the embedded IPv4 source address and transport layer port of the encapsulated IPv6
   packet with the IPv4 source address and transport layer port it is encapsulated by according
   to the parameters of the matching mapping rule.  If the two source
   addresses and transport layer ports do not match, the packet MUST be silently discard and a counter
   incremented to indicate that a potential spoofing attack may be
   underway.  Additionally, a CE MUST allow forwarding of packets
   sourced by the configured BR IPv6 address.

cheers,
Ole

---

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Mon, 5 Aug 2013 20:00:27 +0000

The updated text looks reasonable to me.

-----Original Message-----
From: Ole Troan <[email-masked]>
Date: Monday, August 5, 2013 6:16 AM
To: Tom Taylor <[email-masked]>
Cc: Softwires-wg list <[email-masked]>
Subject: Re: [Softwires] Ambiguity in MAP-E receiving rules

>>> 
>> [PTT] Is there any point to having the CPE generate logs? Who would
>>look at them -- the operator or the customer? If logging is useful on
>>the CPE, that should be reflected in our logging drafts, but if not, not.
>> 
>_______________________________________________
>Softwires mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/softwires