Subject: Re: [mobile-ip] How to process HAO

From: Erik Nordmark <[email-masked]>
Date: Tue, 14 May 2002 11:56:15 +0200 (CEST)

> hi Keiichi,
> 
> There was a discussion between Erik Normark and myself. I think
> we concluded on something similar to the following. (correct me
> if missed something, Erik).
> 
> HAO is processed if
> 
>   - if there is a BCE with CoA = IPv6 src and HoA = HAO content
>   - if there is a home registration BCE with HoA = HAO content
>   - if packet contains BU and satisfies the security policy
>     between MN and HA 
>   - if packet contains AH or ESP header and satisfies the security
>     policy check between MN and HA.

[Catching up on email]

I think only in the first case should the HAO be processed without
any additional checks.

So my thinking is that conservative logic looks like this:
	if there is a BCE with CoA = IPv6 src and HoA = HAO content
		accept packet
	if there is NOT a home registration BCE with HoA = HAO content
		drop packet; send "binding missing" error
	verify that packet is IPsec protected e.g. by verifying first
	that AH or ESP is the next header and then later (as part of or
	after IPsec processing) verify that the HoA "matches" the IPsec SA.

Note that "home registration BCE" needs to capture both the case
of an "active" BCE and the case when the HoA is a user of the HA that might
not have an "active" BCE at the time. Whether such entries are captured
using BCEs or something else is an implementation detail.

  Erik

---

From: Francis Dupont <[email-masked]>
Date: Tue, 14 May 2002 16:16:28 +0200

=> first this match is part of IPsec processing (RFC 2401 5.2.1)
and the proposal is to check the policy (i.e. the SPD) which is also
part of IPsec processing.

Regards

[email-masked]