Subject: [Mip4] Comments on draft-ietf-mip4-dsmipv4-07.txt

From: "Vijay Devarapalli" <[email-masked]>
Date: Tue, 4 Nov 2008 20:39:48 -0500

Hi George,

Section 4.3.2 of draft-ietf-mip4-dsmipv4-07.txt has the following text

   The home agent SHOULD check that all inner IPv6 packets received from
   the mobile node over a tunnel with outer source address the home
   address or the care-of address, include a source address that falls
   under the registered IPv6 prefix(es) for that mobile node.  If the
   source address of the outer header of a tunneled packet is not the
   registered IPv4 care-of address or the registered IPv4 home
   addresses, the packet SHOULD be dropped.  If the source address of
   the inner header of an tunneled packet does not match any of the
   registered prefixes the packet SHOULD be dropped.

Why does this say "the packet SHOULD be dropped"? It should say "MUST",
right? IMO, the home agent should strictly enforce ingress filtering on
the source address that the mobile node can use for the inner IPv6
packets.

The following text in section 4.5 needs a minor correction.

      If the code field is set to "1" then the mobile node MUST act as
      follows:

      - If the care-of address mode of operation is used, the mobile
      node MUST be prepared to send/receive IPv6 traffic on its
      interface natively (i.e., without any Mobile IP related tunnel
      headers).  If reverse tunneling is negotiated, then IPv6 traffic
      sent by the mobile node may be reverse tunneled via the foreign
      agent using either the direct delivery style or the encapsulating
      delivery style as defined in [RFC3024] for IPv4 traffic.

I assume you are talking about FA care-of address mode. So the paragraph
should say

      - If the foreign agent care-of address mode of operation is used
....

Finally we might need to explain in more detail what happens when the
foreign agent is a VPN gateway as described in RFC 5265. I believe Yaron
raised this issue. In case you set the code in the IPv6 Prefix Reply
Extension to "1" in foreign agent care-of address mode, then the IPv6
packets for the mobile node would actually be encapsulated in an IPsec
tunnel between the MN and the VPN GW, instead of being sent as native
IPv6 packets. So we might need a short paragraph describing this. 

Vijay
--
Mip4 mailing list: [email-masked]
    Web interface: https://www.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/

---

From: "George Tsirtsis" <[email-masked]>
Date: Wed, 5 Nov 2008 08:57:10 +0000

> the source address that the mobile node can use for the inner IPv6

GT> SHOULD is the right language here IMO since this is not an
interoperability issue. SHOULD always means that one should do this
unless they have a very good reason not to.

>      - If the foreign agent care-of address mode of operation is used

GT> Yes, thanks.

> IPv6 packets. So we might need a short paragraph describing this.

GT> We already discussed with Yaron and agreed to add language wrt
security devices in general being aware of the new encapsulations
defined in this spec.

Thanks

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 05 Nov 2008 11:16:15 -0800

> unless they have a very good reason not to.

Folks in the past have argued that it is a big concern if the home agent 
does not perform ingress filtering on packets coming through the tunnel 
with the mobile node. Because of this, we had to add text to RFC 3963 
that says the home agent must verify that the source address on the 
inner packet belongs to the prefixes allocated to the mobile router.

But if folks in the MIP4 WG and the IESG are fine with not requiring the 
home agent to perform ingress filtering on the packets coming out of the 
tunnel, its fine with me too.

> security devices in general being aware of the new encapsulations

Can you forward that text, please?

Vijay

---

From: "George Tsirtsis" <[email-masked]>
Date: Thu, 6 Nov 2008 08:33:54 +0000

...
> Can you forward that text, please?

Here it is (added at the end of section 5).
               "Security devices should look for IPv6 packets encapsulated over
                IPv4 either directly to the mobile node's care-of address or via
                double encpasulation first to the mobile node's IPv4 home
                address and then to the mobile node's care-of addres.
                Interactions with Mobile IPv4 and IPsec have been covered
                elsewhere, for instance in [RFC5265] and [RFC5266]."