Re: IPv4 mapped address considered harmful

[Mark Tinberg <tinberg () securepipe com>]

On Fri, 23 Aug 2002, Jun-ichiro itojun Hagino wrote:
>                  IPv4 mapped address considered harmful
>                draft-itojun-v6ops-v4mapped-harmful-00.txt

[snip]

I'm not sure that I agree with your analysis.  The security implications 
of IPv4-in-IPv6 addressing are no different than IPv4 addressing today.  
Rolling out IPv6 will not remove the need for packet filtering routers 
and firewalls.  One can currently send IPv4 packets with the source 
address set to 127.0.0.1 or 255.255.255.255 with undesirable effects, 
these packets should be blocked at your border and not allowed into your 
network, the same with :ffff::127:0:0:1.

No change to the IPv6 protocol or network stacks is required, one only 
needs to maintain existing best practices by using simple packet filtering 
devices.

-- 
Mark Tinberg <MTinberg () securepipe com>
Network Security Engineer, SecurePipe Inc.
Remember:  Wherever you go, there you are!
Key fingerprint = AF6B 0294 EE33 D802 F7A1  38A4 CF52 5FE0 7470 E5F7

        Your daily fortune . . . 

"No self-respecting fish would want to be wrapped in that kind of paper."
                -- Mike Royko on the Chicago Sun-Times after it was
                   taken over by Rupert Murdoch