Subject: Re: [mobile-ip] CN to MN (Sending Binding Acknowledgement)

From: [email-masked]
Date: Sat, 10 Aug 2002 11:50:04 +0800

> > Case 2: BU accepted for deletion (lifetime == 0)
> > src = HoA
> > dest = CN
> > 
> > BAck sent with src = CN, dest = HoA
> > If src in BU is not HoA but legal RH address, then BAck dest = 
> this src
> > address, RH2 = HoA
> > 
> > 
> > Case 3: BU not accepted
> > src = CoA / HoA / other addresses
> > dest = CN
> > 
> > BAck sent with src = CN, dest = HoA
> > If src in BU is not HoA but legal RH address, then BAck dest = 
> this src
> > address (no RH2 in this case since binding not accepted)
> 
> 
> No. Per issue #92 CNs will not respond to HoA if the src is 
> unsuitable.

That means checking of whether the src address is legal for routing 
purpose, is compulsory no matter whether if it's (src address's) a HoA or 
not?

> So: 
> 
>   BAck sent with src=CN, dest=bu src, RH2=hoa
> 
> I think this applies to both cases 2 and 3. The real 
> differentiator is
> is (1) whether bu src is equal to home address or not, and then if
> not (2) whether the bu src is a suitable address or not.
> 
>   The acknowledgement is sent to the Source Address of the IPv6 
> header   that carried the Binding Update. Note that this procedure is
>   independent from the treatment of regular packets and does not use
>   information from the Binding Cache.
> 
>   If the Source Address field does not contain a global unicast 
> address,   the Binding Acknowledgement MUST NOT be sent.
> 
>   If the address is a global unicast address, further processing
>   depends on whether this address is the home address of the 
> mobile node
>   or not. If the Binding Update does not contain a Home Address 
> destination   option, then the source address is the home address 
> of the mobile
>   node. If so, the Binding Acknowledgement MUST be sent directly 
> to this address.
>   Otherwise, the Binding Acknowledgement MUST still be sent to 
> the source address,
>   but a Type 2 Routing Header MUST be added to the packet to 
> carry the
>   home address.
> 

Therefore, binding cache information is not to be used when sending 
BAck. 
The src address must be checked if it's legal.
Determination of whether RH2 is to be used only if the BU contains a dest 
opt for HoA.
If there's no dest opt for HoA, then BAck is sent directly to the src 
address.
As Erik pointed out, is it necessary to use RH2 if the BAck is to return a 
failure status code?
Will there be any security loophole in this case?

Regards,
Vrizlynn Thing

---

From: Vrizlynn Thing <[email-masked]>
Date: Tue, 20 Aug 2002 08:09:09 +0800

----- Original Message -----
From: "Jari Arkko" <[email-masked]>
To: <[email-masked]>
Cc: "Mobile IP Mailing List" <[email-masked]>
Sent: Monday, August 19, 2002 5:47 PM
Subject: Re: [mobile-ip] CN to MN (Sending Binding Acknowledgement)

>
> This is debatable, I think. I'm not sure I see why we would _have_ to send
> it either with RH2 or without. Couldn't we simply do it the same way as we
> do for the regular BA?
>
> I don't think we have any security loophole if we always respond to the
same
> source address that was in the request. Adding RH2 doesn't really cause
anything
> terrible to happen, as the result will stay within the same node.
>

I believe we could do that in a consistent way (sending RH2 even in event of
failure status for BAck, if dest opt is used),
if it doesn't raise any security issue.

Vrizlynn Thing (Ms.)
Senior Engineer

Laboratories for Information Technology
21 Heng Mui Keng Terrace
Singapore 119613
Tel: +65 68746728
Fax: +65 67768109
Email: [email-masked]

---

From: Jari Arkko <[email-masked]>
Date: Mon, 19 Aug 2002 12:47:21 +0300

Appologies from the list admin:
        Somehow this got mis-filtered, but is important for the list!

[email-masked] wrote:

Yes.

Yes.

Yes.

Yes.

Yes.

I don't think we have any security loophole if we always respond to the same
source address that was in the request. Adding RH2 doesn't really cause anything
terrible to happen, as the result will stay within the same node.

Jari