Subject: RE: [mobile-ip] Comments on Draft 16

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Tue, 2 Apr 2002 13:01:21 +0200

=> The problem is whether we can allow a node to reverse
tunnel to the HA, when using a site-local address as
a home address, without authenticating the tunnel. 
The problem is not so much in the reverse tunnelling 
part, but rather due to using a Site-local HoA, which
is most likely communicating with a Site-local address
within the home site. So by not authenticating the tunnel
we're allowing anyone to spoof the HoA and start sending 
messages to a server within the home site, that perhaps
is not meant to be reached from outside the site. 
Of course the question is, since the server's replies
will be sent to the MN, is this a problem? 
But independantly of that, if the tunnel is not
authenticated, an outsider is getting a hole
that he wouldn't normally get with standard IPv6
routers on the border of the site.

  > 2. When RO is used, a CoA is not site-local, so this isn't
  >     a problem either.

=> Well in theory you can have a site-local
CoA when talking to a CN in the same site. I don't
know if people want to allow this in the spec though.

  > 3. Authentication of the tunnel. Is there some difference
  >     in the security impacts whether or note link/site-local
  >     addresses or global addresses are used? 

=> See above and let me know if it makes any sense :)
Link local traffic is not forwarded by the HA. At least
this is what the draft said till 15. I don't know if
that was changed in 16, I haven't checked it in detail.

Hesham

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 2 Apr 2002 14:34:07 +0200 (CEST)

> routers on the border of the site.

Hesham,

I don't think allowing reverse tunnels without IPsec protection adds any
new residual threats as long as the HA verifies that packets contain
an outer source = CoA and an inner source = HoA (where there is a valid
binding between HoA and CoA).

For example, in the site-local case, if there is no internal ingress filtering
within a site then anybody could spoof site-local source addresses
without using MIPv6.

Did you mean "IPsec" when you said "authenticated" or did you mean
"verified"? (the term we used for HAO verification by CNs)

  Erik

---

From: Vladislav Yasevich <[email-masked]>
Date: Tue, 02 Apr 2002 18:19:16 -0500

I guess I missed the whole site-local issue in
all the discussion but...

I think there might be a problem for a mobile use
site-local addresses.

First, to use a site-local address the mobile would
have to register it with a HA.  However, there is
no place in the BU or a BCE to specify a zone id
(I may have missed this in the new draft).

Second, even if there was space in the BCE and a BU, the zone
id would be at least meaningless and at worst incorrect
to the home agent, which could potentially be multi-sited.
The zone ids on the home agent most likely will not be
the same as the ids on the mobile node.

To me, it looks like site-local addresses will be problematic
once moving away from home.

-vlad  

-- 
++++++++++++++++++++++++++++++++++++++++++++++++++++
Vladislav Yasevich		IPv6 Project Lead
Compaq Computer Corp.		
110 Spit Brook Rd ZK03-3/T07	Tel: (603) 884-1079
Nashua, NH 03062		Fax: (435) 514-6884