Subject: [Mip6] Question about RFC3775 10.4.5

From: "K.Kawaguchi" <[email-masked]>
Date: Mon, 13 Mar 2006 20:34:19 +0900

Hi all,

I have one question.

RFC3775 wrote,
---
10.4.5.  Handling Reverse Tunneled Packets

   o  Otherwise, when a home agent decapsulates a tunneled packet from
      the mobile node, the home agent MUST verify that the Source
      Address in the tunnel IP header is the mobile node's primary
      care-of address.  Otherwise, any node in the Internet could send
      traffic through the home agent and escape ingress filtering
      limitations.  This simple check forces the attacker to know the
      current location of the real mobile node and be able to defeat
      ingress filtering. This check is not necessary if the reverse-
      tunneled packet is protected by ESP in tunnel mode.
---

Case: The reverse tunneled packet is not protected by ESP in tunnel
      mode.  When the home agent find the illegal care-of address,
      what should the home agent do?

We want to obtain a clear answer as follows. 

  (a) The home agent silently discard.
  (b) The home agent send the destination unreachable to the illegal
      care-of address.
  (c) Both (a) and (b) are good because there is no description.

PS.
This question is related to the test item of TAHI.
  http://cert.v6pc.jp/mipv6/doc-3.3/mipv6-ha/HA_6_2_1.html

Best regards
---
Kiyoaki KAWAGUCHI [email-masked]

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Basavaraj Patil <[email-masked]>
Date: Mon, 13 Mar 2006 10:51:01 -0600

Silently discard.

-Raj

---

From: Francis Dupont <[email-masked]>
Date: Mon, 13 Mar 2006 18:08:42 +0100

In your previous mail you wrote:

   
   
=> (a) is better because (b) can give a reflection DoS attack and
is far more complex (what error to raise, mandatory rate limiting, etc).

Regards

[email-masked]

---

From: "K.Kawaguchi" <[email-masked]>
Date: Tue, 14 Mar 2006 09:17:52 +0900

Thanks Mr.Raj and Mr.Dupont,

I also think that HA should silently discard.
Because it is necessary to be defended just like using IPsec.

When this situation is tested, the TAHI test suite checks that
HA silently discard.

Best regards
---

"Re: [Mip6] Question about RFC3775 10.4.5 "