Subject: [mobile-ip] non-security comments to Draft-16

From: George Tsirtsis <[email-masked]>
Date: Thu, 28 Mar 2002 07:22:20 -0500

I hope the working group is still interested for a couple of non-security
comments on this draft.

I am reading this after long time and a lot of things are still not clear to
me but I thought the following points may be useful.

1. Reverse Tunneling
In section 9.5. "Handling Reverse Tunneled Packets from a Mobile Node"
There is a statement:

"  A home agent MUST support decapsulating reverse tunneled packets
   sent to it from a mobile node's home address.  "

...which I think it is absolutely correct although the justification that
follows is not as strong as I think the requirement is...but anyway, this is
not important. What is important is that section 7.2. "Requirements for IPv6
Home Agents" does not include the above....I think that if this is a MUST
then it should be listed in 7.2.

2. Triangular routing 
Just checking but is this still possible? It seems that it is if the MN does
not send a BU to the CN. i.e.: there is nothing in the spec that says that
the MN MUST send a BU, is it?

Regards
George

---

From: Jari Arkko <[email-masked]>
Date: Sat, 30 Mar 2002 17:12:41 +0200

George Tsirtsis wrote:

> not important.

The text seems a bit outdated. How about this:

A home agent MUST support decapsulating reverse tunneled packets sent
to it from a mobile node's home address. Such reverse tunneled packets
MAY be discarded unless accompanied by a valid AH or ESP header,
depending on the security policies used by the home agent. In any
case, the home agent MUST check that the source address in the
tunneled packets corresponds to the currently registered location of
the mobile node, as otherwise any node in the Internet could send
traffic through the home agent and escape ingress filtering
limitations.

The support for authenticated reverse tunneling allows the home agent
to protect the home network and correspondent nodes from malicious
nodes masquerading as a mobile node, even if they know the current
location of the real mobile node. The support for encrypted reverse
tunneling allows mobile nodes to defeat certain kinds of traffic
analysis.

> What is important is that section 7.2. "Requirements for IPv6

How about this:

Every home agent MUST support decapsulating reverse tunneled packets
sent to it from a mobile node's home address. Every home agent MUST
also check that the source address in the tunneled packets corresponds
to the currently registered location of the mobile node.

Question: is there something else missing from the list?

Jari