DS-Lite Security: a Reproducible Full-Stack Attack Testbed, 15 Executed Attacks, a Five-Dimensional Taxonomy, and Verified Mitigations

Reproducible artifact for the article "Executed Security Analysis of Dual-Stack Lite: Full-Stack Attack Execution, a Five-Dimensional Taxonomy, and Mitigation Strategies" (submitted to Computers & Security). Contains the one-command Docker testbed realizing the DS-Lite (RFC 6333) reference architecture across the data, control, and management planes; 15 attack tools spanning softwire spoofing/interception/injection, fragment-reassembly poisoning, PCP abuse, DHCPv6/DNS AFTR-discovery hijacking, and DS-Lite MIB access over SNMP; an independent verifier (packet captures plus direct reads of the AFTR and B4 state, and observed device behavior) with the per-attack reference captures for the baseline, every attack, and every mitigation before and after it is applied; the five-dimensional attack taxonomy (Landing Surface, Impact, Architectural Layer Dependency, Affected-Population Scope, Attacker Position) with its classifier and quality-verification scripts; one attack-defense tree per attack rendered with QuADTool, the PRISM reachability check, and the binary mitigation-coverage matrix; and the 11 verified, reversible mitigations with their apply/verify scripts. The article is self-contained; this archive holds the exhaustive supporting detail and regenerates every numerical result and capture from one command.