Subject: About Teredo authentication indication

From: <[email-masked]>
Date: Mon, 23 Aug 2004 08:23:39 +0300

Hi,

In draft-huitema-v6ops-teredo-02.txt it is said in section 5.1.1 that "Both ID-len and AU-len can be set to null values if the server does not require an explicit authentication of the client.". When both the client identifier and the authentication value are set to null, the authentication indication gets a total length of 13 bytes. In such a case, the encapsulated IPv6 packet will not start from a memory address that is divisible by 4.
Doesn't this cause problems on platforms that need to worry about memory alignment?

Thanks,
Markku

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Mon, 23 Aug 2004 21:12:24 +0200

> In draft-huitema-v6ops-teredo-02.txt it is said in section 5.1.1 that
> "Both ID-len and AU-len can be set to null values if the server does
> not require an explicit authentication of the client.".

FYI, that's what all 3 Teredo implementation I know do (Windows
 Advanced Networking, ng_teredo and miredo).

> When both the
> client identifier and the authentication value are set to null, the
> authentication indication gets a total length of 13 bytes. In such a
> case, the encapsulated IPv6 packet will not start from a memory
> address that is divisible by 4. Doesn't this cause problems on
> platforms that need to worry about memory alignment?

Yes. With the current specification, it's necessary to move the packet
in memory prior to reading/writing the Origin indication and/or the
encapsulated IPv6 packet header.

Unfortunately, mandating properly aligned Authentication header would
break existing implementations. That said, Teredo does not really work
at the moment.

-- 
Rémi Denis-Courmont
http://www.simphalempin.com/home/infos/cv.shtml.en

---

From: "Christian Huitema" <[email-masked]>
Date: Tue, 24 Aug 2004 13:35:39 -0700

> encapsulated IPv6 packet header.

The authentication header is only present: when authentication is actually used, in which case the client identifier and authentication values are not set to null; and when in the absence of actual client identification client and server use a nonce to secure the RS/RA exchange. In the second case, the alignment may be weird, but it only concerns a very small fraction of the packets; the regular data packets and the Teredo bubbles will be properly aligned. So, I don't think we have a really big problem...

-- Christian Huitema