Subject: 2401bis Issue # 86 -- Add IPv6 mobility header message type as selector

From: Karen Seo <[email-masked]>
Date: Tue, 30 Sep 2003 12:37:45 -0400

Folks,

Here's a description and proposed approach for:

IPsec Issue #:  86

Title:		Add IPv6 mobility header message type as selector

Description:
============
On 7/11/03, Francis Dupont posted a message to the ipsec-policy 
working group in which he, among other things, asked that we add the 
IPv6 mobility header message type (MH Type) as a selector. (For 
details, see 
http://ietf.org/internet-drafts/draft-ietf-mobileip-ipv6-24.txt).

Should we add the IPv6 mobility header message type (MH Type) as a selector?

Proposed approach:
==================
Modify 2401bis along the following lines:

1. Change "upper layer protocol" to "next layer protocol". (We made 
this change to AH and ESP previously.)
2. Add the mobility header as another possible "next layer" protocol
3. Add mobility header type (MH Type) to the list of selectors 
supported in the SPD and in IKEv2.
4. The processing text stays the same.

Thank you,
Karen

---

From: Jari Arkko <[email-masked]>
Date: Tue, 30 Sep 2003 21:23:25 +0300

Karen Seo wrote:
> On 7/11/03, Francis Dupont posted a message to the ipsec-policy working 
> group in which he, among other things, asked that we add the IPv6 
> mobility header message type (MH Type) as a selector. (For details, see 

Yes. Future protection of mobility signaling using IPsec could
then benefit from the higher granularity of the selectors and
policies.

(Question: did you already cover ICMP types in some earlier
update?)

> 1. Change "upper layer protocol" to "next layer protocol". (We made this 
> change to AH and ESP previously.)
> 3. Add mobility header type (MH Type) to the list of selectors supported 
> in the SPD and in IKEv2.

Agree.

--Jari

---

From: Karen Seo <[email-masked]>
Date: Tue, 30 Sep 2003 15:01:45 -0400

Jari,

	See reply below.

>>working group in which he, among other things, asked that we add 
>>the IPv6 mobility header message type (MH Type) as a selector. (For 
>>details, see 

	Sounds good.

>(Question: did you already cover ICMP types in some earlier

	Only the PMTU discovery aspect has been written up so far
	(plus the 3 cases of dropped packets where we proposed sending
	an ICMP unreachable.)  We have done a couple of passes on
	writing up the ICMP issues, but I haven't yet completed the
	next revision.   I'm probably going to need to wait for Steve's
	input before it will be ready to send out, so it might not go
	out until after 10/13.  But there will definitely be a 2401bis
	writeup on this topic.

>>4. The processing text stays the same.

	Thank you.

Karen

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 30 Sep 2003 23:50:08 +0300

> (Question: did you already cover ICMP types in some earlier

IKEv2 already includes them:
----------------------------------------------------------------------
3.13.1 Traffic Selector
...
   o  Protocol ID (1 octet) - Value specifying an associated IP
      protocol ID (e.g., UDP/TCP/ICMP). A value of zero means that
...
   o  Start_Port (2 octets) - Value specifying the smallest port
      number allowed by this Traffic Selector. For protocols for
      which port is undefined, or if all ports are allowed by
      this Traffic Selector, this field MUST be zero. For the
      ICMP protocol, the two one octet fields Type and Code are
      treated as a single 16 bit integer port number for the
      purposes of filtering based on this field.

   o  End_Port (2 octets) - Value specifying the largest port
      number allowed by this Traffic Selector. For protocols for
      which port is undefined, or if all ports are allowed by
      this Traffic Selector, this field MUST be 65535. For the
      ICMP protocol, the two one octet fields Type and Code are
      treated as a single 16 bit integer port number for the
      purposed of filtering based on this field.
-- 
[email-masked]
SSH Communications Security                  http://www.ssh.fi/
SSH IPSEC Toolkit                            http://www.ssh.fi/ipsec/

---

From: Scott Fluhrer <[email-masked]>
Date: Tue, 30 Sep 2003 14:56:15 -0700 (PDT)

> IKEv2 already includes them:

You probably should specify if the Type or the Code is the most
significant octet of the 16 bit integer.

-- 
scott