Subject: [Mip6] Re: Last call comments for draft-ietf-mip6-ikev2-ipsec-07

From: Francis Dupont <[email-masked]>
Date: Sat, 09 Dec 2006 14:31:30 +0100

In your previous mail you wrote:

   this text was added to address some concerns that
   not all IPsec implementations support all selectors.

=> the support of all selectors was never mandatory... In fact,
some SG implementations support only addresses as selectors
(avoiding all fragment issues :-)!

   this was true in 2401 case at least. don't know
   about 4301 IPsec implementations. but we can add the
   note.
   
       IPsec implementations are compatible with this document even if they
       do not support fine grain selectors such as the Mobility Header
       message type and ICMPv6 message type.  Note that such IPsec
       implementations are not compliant to RFC 4301 [5].
   
=> in doubt perhaps we should remove the last statement
(about 4301 compliance)?

   > 5) Section 4.3, "Similarly, the home agent starts to expect the new
   >    source address in the tunnel packets received from the mobile
   >    node."
   > 
   >    An RFC4301 IPsec implementation does not use the outer source
   >    address in tunnel mode packets for anything, so it doesn't "expect"
   >    anything. Similarly, Section 5 says "Typical IPsec processing does
   >    not check the outer source address.". More correctly, this is not
   >    part of IPsec processing as described in RFC 4301.
   
   that is correct. however, this check is mandated by
   RFC 3775. section 15.7 of RFC 3775
   
       When receiving
       tunneled traffic, the home agent verifies that the outer IP address
       corresponds to the current location of the mobile node.  This acts as
       a weak form of protection against spoofing packets that appear to
       come from the mobile node.  This is particularly useful, if no end-
       to-end security is being applied between the mobile and correspondent
       nodes.  The outer IP address check prevents attacks where the
       attacker is controlled by ingress filtering.
   
=> I believe this point was already discussed in the mailing-list:
this check is not needed (so SHOULD NOT be performed) for authenticated
packets. Conclusion: this seems to be a problem of wording/context...

Regards

[email-masked]

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6