Subject: Re: MIPv6 questions

From: Mohan Parthasarathy <[email-masked]>
Date: Wed, 5 Apr 2000 12:40:51 -0700 (PDT)

>    In section 5.4 and other places, the draft says that when a packet
>    with HOME address option is recieved it should be processed first
>    before IPSEC is done.
> 
> => the idea is to use the home address for SA lookup.
> 
Agreed.
>    Thus while AH ICV is being computed ip6_src of the IPv6 header contains
>    the HOME address.
> 
> => it is a consequence of the previous point: inbound IPSec processing
> should be done after the home address option processing. The real problem
> is to know what is it exactly the home address option processing, texts
> say replace addresses in source by the one in the option, verbal
> explanations say to swap them which is better because the care-of address
> (the source address before processing) must be kept and protected.
> 
Depending on swap or replacement, the results will differ. So, my
original question was to find out the intent of the text in the
draft. I prefer swap and if swapping is done before IPSEC processing
on inbound, a similar change should happen on outbound so that
after the insertion of the home address option, ICV should be
computed first and then swap the address.

>    If you refer to 10.2 for outbound processing with Home address
>    options, it states that HOME address option is inserted, ip6_src
>    is replaced with Care of Address and then AH ICV is computed. ip6_src
>    is not same in these two cases...
> 
> => the piece you'd like is the AH processing rule for the home address
> option which depends a bit of the way you "fully assemble" the packet.
>  
So, are you saying that the text needs to be clarified with respect
to this ?

-mohan

> [email-masked]
> --------------------------------------------------------------------
> IETF IPng Working Group Mailing List
> IPng Home Page:                      http://playground.sun.com/ipng
> FTP archive:                      ftp://playground.sun.com/pub/ipng
> Direct all administrative requests to [email-masked]
> --------------------------------------------------------------------
> 
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Francis Dupont <[email-masked]>
Date: Thu, 06 Apr 2000 10:47:24 +0200

> (the source address before processing) must be kept and protected.
   Depending on swap or replacement, the results will differ.

=> with a simple replacement the care-of address is no more present
and as I said the care-of is both needed and must be protected then
in the reassembled packet used for AH ICV both the home address and
the care-of address will appear in the source address and the home
address option. The only question is which one will be in the source
address...

   So, my original question was to find out the intent of the text in the
   
=> or the reassembly processing will swap again the address (two swaps
are the identity function).

   
=> first I believe the text will never become too clear, second if we have
this discussion obviously the text is not clear enough!

Regards