Subject: draft-ietf-ipngwg-addr-arch-v3-10.txt

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Thu, 19 Sep 2002 07:26:14 +0900

based on v6ops interim meeting discussion, it seems that there are fair
	amount of consensus that IPv4 mapped address on wire is harmful (causes
	security drawbacks).
	draft-itojun-v6ops-v4mapped-harmful-00.txt

	so, i would like to ask you to update draft-ietf-ipngwg-addr-arch-v3-10
	section 2.5.5, to:
	- constrain use of IPv4 mapped address to IEEE Std 1003.1 (RFC2553) API,
	  and that API only.  IPv4 mapped address must not appear on wire,
	  in any of IPv6 header fields, extension header fields, or payloads
	also, please consider the following too:
	- remove IPv4 compatible IPv6 addrses, as it is no longer used in
	  draft-ietf-ngtrans-mech-v2-00.txt

itojun (as the author of the draft, not as co-chair of v6ops)
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Robert Elz <[email-masked]>
Date: Thu, 19 Sep 2002 16:41:42 +0700

Date:        Thu, 19 Sep 2002 07:26:14 +0900
    From:        Jun-ichiro itojun Hagino <[email-masked]>
    Message-ID:  <[email-masked]>

  |  IPv4 mapped address must not appear on wire,
  |  in any of IPv6 header fields, extension header fields, or payloads

I'm sure you didn't really mean that, as that would be going way too
far.

That is, you aren't seriously prohibiting any data that happens to
be 80 bits of zeroes, followed by 16 bits of ones, followed by
32 bits of something else, from ever appearing in a packet payload
are you?  Or even as a data pattern that might happen to occur in
some IP header (perhaps encryption data in the ESP header).

I have no problems with prohibiting them in address fields in IPv6
headers ("the" IPv6 header, and the others that contain addresses),
but anywhere else, the IPv6 address architecture doc has no business
treading.

So, make that "in any address fields of the IPv6 header, or extension
headers"

kre

---

From: Vladislav Yasevich <[email-masked]>
Date: Thu, 19 Sep 2002 09:57:28 -0400

> 	  in any of IPv6 header fields, extension header fields, or payloads

I disagree.  First off all, "must not" is way too strong of a
requirement.  If someone understands all the potential
harmfull effects and is prepared to deal with them, then
the addresses can be allowed.

Secondly, I don't think that the addressing architecture should
forbid the use of the address in an extension header.  That is
for the extension header to define.

-vlad
-- 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Vladislav Yasevich		Tru64 UNIX - IPv6 Project Lead
Hewlett Packard 		Tel: (603) 884-1079
Nashua, NH 03062		ZKO3-3/T07

---

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Thu, 19 Sep 2002 23:56:22 +0900

>the addresses can be allowed.

	i'm not optimitic about it.

>for the extension header to define.

	in which kind of extension header IPv4 mapped address make sense?
	certainly not the extension header.

itojun

---

From: Vladislav Yasevich <[email-masked]>
Date: Thu, 19 Sep 2002 11:24:38 -0400

> 	certainly not the extension header.

There is no point forbidding it from the Destination Options as
one example.  Some new option at some point in time might want
to use a mapped address.  There should be a specific prohibition
on it.

Additionally (and what I was trying to say before), the addressing
architecture does not and should not talk about extension header and
what's permitted in them.

-vlad

---

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Fri, 20 Sep 2002 00:43:33 +0900

>to use a mapped address.  There should be a specific prohibition

	what for?  i don't see any valid use of it.

>what's permitted in them.

	i'd like to leave it to authors/ipv6wg chairs.

itojun

---

From: Vladislav Yasevich <[email-masked]>
Date: Thu, 19 Sep 2002 13:12:46 -0400

oops...

> to use a mapped address.  There should be a specific prohibition
                                   ^^^^^^
                                  should not

---

From: Hemanth T D <[email-masked]>
Date: Fri, 20 Sep 2002 12:10:04 +0530

Agree 100% with Vlad. 

v4 mapped address exists to facilitate transition. In a transition
scenario one inherits whatever is good or bad in v4 security anyway. 

IMHO I think we should debate on where to introduce security measures:
packet itself (as in this field in the packet should not contain v4
mapped address) or packet processing (do not source route to a given v4
destination unless ...).

So I believe there is not good enough reason to forbit the usage of v4
mapped address.

Hemanth.