Subject: RE: [Monami6] using MH is not a magic "re-use"

From: "Tsirtsis, George" <[email-masked]>
Date: Tue, 14 Nov 2006 06:31:24 -0800

Having missed the MONAMIv6 meeting I am trying to decipher the
discussion on the mailing list only so I might be missing some context.

The MR already does work on behalf of the LFN and other nodes in the
mobile network. If this work is done based on static configuration then,
the same can be done for moving flows. It is obvious that if the MR does
not know what to do, it will not do anything. 

What is the problem here?

George
> -----Original Message-----
> From: Alexandru Petrescu [mailto:[email-masked]]
> Sent: Tuesday, November 14, 2006 9:21 AM
> To: Soliman, Hesham
> Cc: Monami6 WG
> Subject: Re: [Monami6] using MH is not a magic "re-use"
> 
> Soliman, Hesham wrote:
> >>>> How?  There isn't any way for LFNs to inform MR about
> >>>> delegating authorization.
> >>>
> >>> => Huh? What authorisation does the LFN delegate for the MR to
> >>>  send a BU for the entire prefix, including its own address???
> >>
> >> Because HA is sure that MR is allowed to send a BU for that
> >> prefix as suggested by the Prefix Table, which is hard-wired.
> >
> > => And if the prefix is already hardwired, then obviously the MR is
> >  authorised to bind addresses derived from that prefix. I don't
> > understand what isn't clear here.
> 
> It's not 'binding' as in binding updates.
> 
> The Prefix Table authorizes MR to setup forwarding information about
> its HoA and that MNP, but in no way about LFN (of that MNP).  Flow
> bindings on MR mean MR do stuff with the LFN address, for which
> there's no authorization.
> 
> Do you think a particular LFN should be imposed the MR's interface
> preference without giving it approval?  How would MR know what apps
> run on LFN?  Makes no sense to me.
> 
> >> A HA wouldn't have a way to check addresses in the flow bindings
> >> unless the Prefix Table were extended.  And one can't extend the
> >> Prefix Table with hardwired preferences, because there's no way
> >> for HA to know in advance what apps may or may not run on LFNs.
> >
> > => This is completely irrelevant, if the MR owns the right to bind
> >  the prefix then it has the same right for all addresses under that
> >  prefix, no knowledge of apps is necessary. If you have a specific
> >  attack in mind then share it with the list.
> >
> >>
> >> The MR doesn't inject any route without HA's prior hard-wired
> >> approval.
> >>
> >> You seem to make a distinction between LFNs and MNNs.
> >
> > => No I don't, not in the context of this discussion.
> >
> >> Flow preferencess of MNNs that are actually MNs (not LFNs) can't
> >>  be pre-configured at MR's HA anyways.  So we're left with LFN
> >> discussion only.
> >>
> >> One can't instruct a MR's HA about the flow preferences of some
> >> random MN that may come by.  And that MN's flow preferences have
> >>  no sense on the MR.
> >
> > => I think you're confusing different issues here. Any router on
> > the internet can inject routes for prefixes it is authorised to
> > route. Routers also load balance flows all the time, nothing new
> > here. If an MNN is served by the MR and it derives an address based
> >  on the MNP then the MR has the authority to route flows in the
> > best way it sees fit.
> 
> I don't think that way.  I think MR has no right to decide on behalf
> of LFN what interface is best appropriate for what application.
> 
> Basically MR can't do anything about MNP more than just what the
> Prefix Table says.
> 
> You seem to think otherwise - that's ok.
> 
> > This is not a security discussion, if you have a threat specific to
> >  this discussion then share it with the list.
> 
> That's fine.  We may be running in circles...
> 
> Alex
> 
> _______________________________________________
> Monami6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/monami6

_______________________________________________
Monami6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/monami6

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 14 Nov 2006 15:45:16 +0100

Tsirtsis, George wrote:
> The MR already does work on behalf of the LFN and other nodes in 
> the mobile network. If this work is done based on static 
> configuration then, the same can be done for moving flows.

How would HA statically configure information about applications
running on LFNs?  HA does statically configure 'authorization'
information about MR's HoA and MNP.

> It is obvious that if the MR does not know what to do, it will not 
> do anything.

MR shouldn't do anything about LFN's IP address (shouldn't include it
in flow bindings) unless LFN or HA auhtorized MR to do so.

Alex