Subject: [manet] NHDP's Packet and Message

From: Abdussalam Baryun <[email-masked]>
Date: Fri, 13 Jul 2012 04:26:22 +0200

Hi Thomas,

> I agree with Ulrich.
>
>
> Note that this is all about "messages" in as much as NHDP is concerned.
>

It is about securing neighbor discovery, the draft: manet-nhdp-sec-02

>
> 1) NHDP specifies something akin to "an implementation may recognize
> additional reasons for considering a HELLO message invalid for
> processing"; this I-D specifies such an additional reason, by way of a
> TLV in HELLO messages.
>

yes it does in NHDP, but it does not restrict to messages only,
because it uses/understands [RFC5444] packets.

>
> 2) NHDP "owns" HELLO messages, and therefore gets first dip on an
> incoming HELLO message post-demultiplication. Including the ICV
> Message TLV in HELLO messages therefore makes sense.
>

It may own/create the [5444] packet carrying the hello messages

AB
==============
>
>
> On 12 Jul 2012, at 22:54, Ulrich Herberg <ulrich at herberg.name> wrote:
>
>
> The document specifies signing/verifying NHDP messages. RFC5444
> packets are not specific to NHDP, and therefore should IMO not be
> discussed in a document entitled "Using Integrity Check Values and
> Timestamps For Router Admittance in NHDP". That's why I suggested to
> handle this in an additional document for RFC5444 packets.
>
> Regards
> Ulrich
>
>
> On Thu, Jul 12, 2012 at 1:39 PM, Abdussalam Baryun <abdussalambaryun
> at gmail.com> wrote:
>
> Hi Ulrich,
>
> I am not expert in security issues, but IMHO, I agree with Chris to
> recommend to include in draft-02 both securing messages and packets
> (in general for packets), so the document should specify NHDP messages
> and MANET packets [AB]. The reasons are first, because NHDP is a MANET
> Interface protocol between neighbor routers. secondly it uses RFC5444
> format that the future MANET routers will use. Third, NHDP uses
> RFC5444 which was specified for information exchange between MANET
> routers.
>
> [AB] http://tools.ietf.org/id/draft-baryun-manet-terminology-00.txt
>
> Regards
> Abdussalam
> =======
>

---

From: Thomas Heide Clausen <[email-masked]>
Date: Fri, 13 Jul 2012 04:40:06 +0200

> It is about securing neighbor discovery, the draft: manet-nhdp-sec-02

No. It is about securing a specific neighborhood discovery protocol - a protocol, whose signaling is carried in RFC5444 _messages_.

> because it uses/understands [RFC5444] packets.

Irrelevant. RFC6130 speaks of reasons for considering messages invalid.

> It may own/create the [5444] packet carrying the hello messages

No, it may not. See how demultiplexing of RFC5444 messages work, as well as what RFC6130 says for HELLO messages.

Thomas

---

From: Abdussalam Baryun <[email-masked]>
Date: Fri, 13 Jul 2012 12:03:26 +0200

Hi,

AB>> It is about securing neighbor discovery, the draft: manet-nhdp-sec-02
>
> No. It is about securing a specific neighborhood discovery protocol - a
> protocol, whose signaling is carried in RFC5444 _messages_.
>

NHDP was not designed for specific purpose of one proactive routing,
but for All MANET Routers. I agree that it specifies messages not
packets as Ulrich mentioned before, but there is no MUST in RFC6130
that its signalling MUST be only messages, we need to consider the
specification's requirement language (MUST, SHOULD, MAY,..etc), there
is no restrictions, there is room for update :)

>>> processing"; this I-D specifies such an additional reason, by way of a
AB>> yes it does in NHDP, but it does not restrict to messages only,
> Irrelevant. RFC6130 speaks of reasons for considering messages invalid.

Why irrelevant? RFC6130 speaks of using [RFC5444] packets to carry
specified NHDP-messages. yes, also speaks of invalid NHDP-messages
please read:

RFC6130> page 40> A router *MAY* recognize additional reasons for
identifying that a message is badly formed and therefore invalid for
processing.

meaning> there may be a use of NHDP packet check as well

> what RFC6130 says for HELLO messages.

Please provide me which page or sentence mentions your understanding
as: *MAY NOT* create 5444-packets. I will do your advise to look into
the RFC6130 again for demultiplexing of NHDP-messages, and will reply.

Thanking you,
Abdussalam Baryun,
==========================================

---

From: Thomas Heide Clausen <[email-masked]>
Date: Fri, 13 Jul 2012 12:35:10 +0200

> is no restrictions, there is room for update :)

No, that is wrong. RFC6130 specifies the use of RFC5444 messages.

If you want to use smoke-signals, carved potatoes or something else not specified in RFC6130, then you're simply not using RFC6130.

This has nothing to do with requirements language.

> meaning> there may be a use of NHDP packet check as well

For exactly the reasons I gave in the above.

Plus, that for RFC6130 to use packet header content would constitute a layer violation (and a very badly designed system).

> the RFC6130 again for demultiplexing of NHDP-messages, and will reply.

I don't think that you understand RFC6130 or RFC5444 at all. 

RFC6130 generates RFC5444 messages, which are carried (as are all RFC5444 messages) in RFC5444 packets.

A protocol generating something not specified in RFC6130 is not RFC6130.

I do not know how it can be made more clear.

Thomas

---

From: Abdussalam Baryun <[email-masked]>
Date: Fri, 13 Jul 2012 13:02:20 +0200

Hi Thomas,

> I do not know how it can be made more clear.

I agreed from before that RFC6130 not specify packets, that was the
point for the discussing the update, however, I beleive NHDP idea can
be extended, and RFC6130 MAY be updated in future.

 Please note that RFC5444 mentions in page 7: Packets MAY
be unicast or multicast and may use any appropriate transport
protocol or none.

Best regards
Abdussalam
==================================================
On 7/13/12, Thomas Heide Clausen <[email-masked]> wrote:
> If you want to use smoke-signals, carved potatoes or something else not
> specified in RFC6130, then you're simply not using RFC6130.
>
> Plus, that for RFC6130 to use packet header content would constitute a layer
> violation (and a very badly designed system).
>
>>
>>> No, it may not. See how demultiplexing of RFC5444 messages work, as well
>>> as
>>> what RFC6130 says for HELLO messages.
>>>
>>

---

From: Ulrich Herberg <[email-masked]>
Date: Fri, 13 Jul 2012 08:27:40 -0700

I agree with Thomas. What you propose is a layer violation. It's like sticking application payload in an IPv6 Extension Header or an L2 frame header.

Ulrich

On Jul 13, 2012, at 3:35, Thomas Heide Clausen <[email-masked]> wrote:

> _______________________________________________
> manet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/manet

---

From: Abdussalam Baryun <[email-masked]>
Date: Sat, 14 Jul 2012 00:05:01 +0200

Hi Ulrich,

Please note that I don't mind your approach in <draft-nhdp-sec>  (so I
am not against, but abstained), I presented my comments more to
support another participant opinion and showing my preferance, but I
will need to study the matter more further to see how I can use NHDP.
Thanking you,

Regards
Abdussalam Baryun
==================

On 7/13/12, Ulrich Herberg <[email-masked]> wrote:
> I agree with Thomas. What you propose is a layer violation. It's like
> sticking application payload in an IPv6 Extension Header or an L2 frame
> header.
>
> Ulrich
>
>> Plus, that for RFC6130 to use packet header content would constitute a
>> layer violation (and a very badly designed system).
>>
>>>