Subject: Re: [Mip6] RE: issue 76: Alt CoA should not be used when traversing IPv4 NAT

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 12 Oct 2006 11:01:33 -0700

Hesham,

sorry for the late reply.

I agree with relaxing the requirement in RFC 3775 to
include an Alt CoA option all the time.

but I don't understand how the checksum option helps.

lets take the following packet

IPv4 hdr (src=ipv4-CoA, dst=ipv4-HA)
IPv6 hdr (src=ipv4-mapped-ipv6-CoA, dst=ipv6-HA)
ESP hdr
Mobility Hdr
     Binding Update
     Checksum option

the checksum option protects the source in the IPv6
hdr. but if there is a NAT on the path, the HA needs
to take the IPv4 CoA in the source address of the
outer IPv4 header as the correct CoA. the NAT would
modify the IPv4 CoA anyway. how does the checksum
option protect the IPv4 Co?

let me know if I missing something obvious.

Soliman, Hesham wrote:

> We also need to add text in sections 4.3 and 4.4 (mobile node and HA
> operation) to require the MN to add this option and require the HA to
> verify it for BUs protected with ESP. 

I am definitely opposed to mandating this new option.

Vijay

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Soliman, Hesham" <[email-masked]>
Date: Thu, 12 Oct 2006 23:42:41 -0700

> outer IPv4 header as the correct CoA. 

=> No, it only takes that outer address as the dst address of its outer
header, the CoA is still the inner address. In other words, the packet
received at the HA (through the NAT) would look like this: 

  IPv4 hdr (src=ipv4-natted, dst=ipv4-HA)
  IPv6 hdr (src=ipv4-CoA-mapped, dst=ipv6-HA)
  ESP hdr
  Mobility Hdr
       Binding Update
       Checksum option

Where ipv4-natted is the modified IPv4 CoA after the packet went through
the NAT.

the packets sent from the HA to the MN, after a NAT is detected would
look like this:

  IPv4 hdr (src=ipv4-HA, dst=ipv4-natted)
  IPv6 hdr (src= ipv6-HA, dst= ipv4-CoA-mapped)
  .....etc

Am I missing something ?

   the NAT would
 > option protect the IPv4 Co?

=> It only protects the inner address. Remember that the inner address
(the one in the v4-mapped address) is still required as the CoA in the
IPv6 packet. The problem with modifying the outer IPv4 address is of
course valid, but that's the problem with NATs and there is not much we
can do about that.

Hesham

---

From: "Soliman, Hesham" <[email-masked]>
Date: Fri, 13 Oct 2006 00:41:09 -0700

One more thing, I guess we both forgot the UDP hdr between the IPv4 and
IPv6 headers. 

Hesham 

 > -----Original Message-----
 > From: Soliman, Hesham [mailto:[email-masked]] 
 > Sent: Friday, October 13, 2006 4:43 PM
 > To: Vijay Devarapalli
 > Cc: [email-masked]
 > Subject: RE: [Mip6] RE: issue 76: Alt CoA should not be used 
 > when traversingIPv4 NAT
 > 
 >

---

From: <[email-masked]>
Date: Fri, 13 Oct 2006 17:19:12 +0300

Also, sorry for commenting this so late.

The original issue was to make sure that the HA sends the BA back
to the right IPv4 address. The way I see this is that the (DS)MIPv6
protocol still creates the BA with the destination set to the
ipv4-mapped-ipv6-CoA, whether from IPv6 src address or altCoa option.

Isn't this whole issue more of an implementation detail of how the HA
does the UDP+IPv4 tunneling internally (=not an issue at all)?

Thoughts?

Markku

>From: ext Vijay Devarapalli [mailto:[email-masked]] 
>Sent: 12 October, 2006 21:02
>To: Soliman, Hesham
>Cc: [email-masked]
>Subject: Re: [Mip6] RE: issue 76: Alt CoA should not be used 
>when traversingIPv4 NAT
>
>Hesham,
>
>I agree with relaxing the requirement in RFC 3775 to include 
>an Alt CoA option all the time.
>
>IPv6 hdr (src=ipv4-mapped-ipv6-CoA, dst=ipv6-HA) ESP hdr Mobility Hdr
>     Binding Update
>     Checksum option
>
>the checksum option protects the source in the IPv6 hdr. but 
>if there is a NAT on the path, the HA needs to take the IPv4 
>CoA in the source address of the outer IPv4 header as the 
>correct CoA. the NAT would modify the IPv4 CoA anyway. how 
>does the checksum option protect the IPv4 Co?
>

---

From: "Soliman, Hesham" <[email-masked]>
Date: Fri, 13 Oct 2006 09:07:55 -0700

> to the right IPv4 address. 

=> No that's not the issue. The issue is really about the consequence of
removing the alt-coa. We all agree it shouldn't be used in this case,
now the question is whether we need to maintain the integrity of the BU
when we don't use the alt-cao. Hence the checksum suggestion.

   The way I see this is that the (DS)MIPv6
 > ipv4-mapped-ipv6-CoA, whether from IPv6 src address or altCoa option.

=> Yes. But this is not what we're discussing.

 > does the UDP+IPv4 tunneling internally (=not an issue at all)?

=> No. See above.

Hesham