Subject: [Mip6] RFC 4877 and specification of SPD entries

From: <[email-masked]>
Date: Wed, 19 Sep 2007 14:33:57 +0200

Upon reading RFC 4877, I should like someone to help clarifying
the meaning of the following two SPD entries.

RFC 4877, section 7.2.2 specifies an SPD entry for return routability 
messages as follows

       mobile node SPD-S:
         - IF local_address = home_address_1 & remote_address = any &
              proto = MH & local_mh_type = HoTi & remote_mh_type = HoT
           Then use SA ESP tunnel mode
           Initiate using IDi = user_1 to address home_agent_1

Then section 7.2.4 specifies an SPD entry for payload packets 

       mobile node SPD-S:
         - IF interface = IPv6 tunnel to home_agent_1 &
           source = home_address_1 & destination = any & proto = X
           Then use SA ESP tunnel mode
           Initiate using IDi = user_1 to address home_agent_1

Two things: First, the SPD entry for payload packets shall replace
source with local_address and destination with remote_address.  Most
likely
a cut/paste error when moving from RFC 3776 (where SPD entries 
were found in an IN and an OUT variant) to RFC 4877.

Second, what does "interface = IPv6 tunnel to home_agent_1" mean as such
a statement is not a normal part of a five-tuple.  

I guess the presence of this statement for payload packets 
shall be understood as the SPD is active when the mobile node is away 
from home and passive when at home.

I guess the absence of this statement for return routability messages 
is because such messages are sent only when away from home.  But if
sent while at home, they will be protected on the way out.  Because the
home agent does not defend the home address when the mobile node is at
home, then packets the other way will not pass the home agent, and will
therefore not be protected on the way to the mobile node and therefore
dropped in the mobile node.

Any help in interpretation will be appreciated.

Christian

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 19 Sep 2007 11:22:36 -0700

> were found in an IN and an OUT variant) to RFC 4877.

Yes, my bad. It should have been local_address and remote_address.

> a statement is not a normal part of a five-tuple.  

The "tunnel to the home agent" terminology comes from RFC 3776. It 
basically refers to the case where you want to protect all reverse 
tunneled payload traffic with ESP in tunneled mode. This "tunnel to the 
home agent" as an SPD parameter is implementation specific.

> from home and passive when at home.

Correct.

> is because such messages are sent only when away from home.  

No. Once the MH Type was added as an IPsec selector, we can say "if 
local_mh_type = HoTi, do this...". If you see RFC 3776, we use the 
"tunnel to the home agent" for return routability messages also, since 
we had to differentiate between a mobility header message reverse 
tunneled through the home agent (for e.g. a HoTi message) and a mobility 
header message sent to the home agent directly (for e.g. a Binding 
Update to the home agent). But now that the MH Type is a selector too, 
we don't have to do this anymore.

Hope that helps.

Vijay

But if