Subject: RE: Automatic tunnels

From: "Christian Huitema" <[email-masked]>
Date: Thu, 31 Jul 2003 09:03:48 -0700

> 	for native-to-6to4, there's no way to protect from abuse (since
> 	2002::/16 has to be advertised, more-specific route is not
> permitted).
> 	how do you address the problem? (pekka's draft outlines the
problem
> 	very well)

Which type of abuse are you concerned with? We can deploy native-to-6to4
relays in several modes:

 - host specific 
	(host is multi-homed to 6to4, local routing entry to 2002::/16)
 - AS specific 
	(some routers act as relay, export a route to 2002::/16 in IGP)
 - Across multiple AS
	(export a route to 2002::/16 in BGP)

The first two modes don't seem particularly prone to abuse. Host
specific relays certainly are not an issue, and the abuse to AS specific
relay fall in the general category of "abusing peering agreements",
which is by no means specific to 6to4. I agree that exporting a route
through BGP is hard to control, as the route can be re-exported by
peering ASes. But, again, this fall in the category of "peering abuses",
which can be contained by proper peering contracts.

-- Christian Huitema

---

From: [email-masked]
Date: Fri, 01 Aug 2003 08:26:40 +0900

> - host specific=20
> - AS specific=20

	we are afraid of our native-to-6to4 device being used as open relay
	of packet (bullet 3 in the above, of course).  the IPv4 source address
	will be ours, so we will get compliants from random people, because of
	malicious traffic from somewhere to 2002::/16.  running 6to4 relay
	router is like running open relay smtp server.

itojun