Subject: [v6ops] I-D Action:draft-ietf-v6ops-tunnel-loops-02.txt

From: [email-masked]
Date: Mon, 24 Jan 2011 13:15:01 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the IPv6 Operations Working Group of the IETF.

	Title           : Routing Loop Attack using IPv6 Automatic Tunnels: Problem Statement and Proposed Mitigations
	Author(s)       : G. Nakibly, F. Templin
	Filename        : draft-ietf-v6ops-tunnel-loops-02.txt
	Pages           : 13
	Date            : 2011-01-24

This document is concerned with security vulnerabilities in IPv6-in-
IPv4 automatic tunnels.  These vulnerabilities allow an attacker to
take advantage of inconsistencies between the IPv4 routing state and
the IPv6 routing state.  The attack forms a routing loop which can be
abused as a vehicle for traffic amplification to facilitate DoS
attacks.  The first aim of this document is to inform on this attack
and its root causes.  The second aim is to present some possible
mitigation measures.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-v6ops-tunnel-loops-02.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Ole Troan <[email-masked]>
Date: Wed, 26 Jan 2011 10:23:22 +0100

Gabi, Fred,

with regards to 6rd.
 - update reference to rfc5969
 - reference 5969's looping mitigation text

in general, make a difference between global tunneling mechanisms like 6to4 and local tunnel mechanisms like ISATAP and 6rd.

cheers,
Ole

On Jan 24, 2011, at 22:15 , [email-masked] wrote:

> <Mail Attachment>_______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops

---

From: Gabi Nakibly <[email-masked]>
Date: Mon, 31 Jan 2011 10:44:14 -0800 (PST)

Hi Ole,
We shall reference rfc 5969 with regard to the mitigation text. 
What do mean by "make a difference"? In what way? The routing loop works the 
same for both types of mechanisms.

Gabi

________________________________
From: Ole Troan <[email-masked]>
To: Gabi Nakibly <[email-masked]>; Fred L Templin 
<[email-masked]>
Cc: IPv6 Operations <[email-masked]>
Sent: Wed, January 26, 2011 11:23:22 AM
Subject: Re: [v6ops] I-D Action:draft-ietf-v6ops-tunnel-loops-02.txt

Gabi, Fred,

with regards to 6rd.

in general, make a difference between global tunneling mechanisms like 6to4 and 
local tunnel mechanisms like ISATAP and 6rd.

cheers,
Ole

---

From: Ole Troan <[email-masked]>
Date: Mon, 31 Jan 2011 21:04:38 +0100

Gabi,

> What do mean by "make a difference"? In what way? The routing loop works the same for both types of mechanisms.

for intra-site tunneling like ISATAP or 6rd you can protect the borders of the tunnelled domain. something you cannot do for global tunnelling mechanisms like Teredo or 6to4.

cheers,
Ole

> To: Gabi Nakibly <[email-masked]>; Fred L Templin <[email-masked]>