Subject: [mobile-ip] CN to MN (Sending Binding Acknowledgement)

From: Vrizlynn Thing <[email-masked]>
Date: Wed, 07 Aug 2002 16:30:51 +0800

Hi all,

On Section 9.4.4 of the Mobile IPv6 internet draft, it was specified that:

"if the packet is to be sent to the mobile node at any address other than the mobile
   node's home address, it MUST be sent using a Routing header...

    -  Whenever the Binding Update is accepted with a nonzero lifetime,
       the routing header will be constructed using the care-of address
       as described in Section 9.6.

    -  Otherwise, if the Source IP Address of the packet containing
       the Binding Update, is legal for inclusion in a Routing Header,
       the routing header will be constructed using that IP address.
       Note that multicast addresses, link-local addresses, loopback
       addresses, IPv4 mapped addresses, and the unspecified address,
       MUST NOT be used within a Routing Header for the Binding
       Acknowledgement.

   Otherwise, if the Binding Update has a zero lifetime but the Source
   IP address is not allowable for use within the Routing Header,
   the Binding Acknowledgment MUST be sent to the mobile node's home
   address."

Is this referring to the Type 0 or 2 RH?
If the "addresses other than Home Address" is referring to the Care-of Address (if caching 
of BU entry is successful), shouldn't Type 2 RH be used with the Home Address in it (as 
in Section 9.6: Sending Packets to a MN)?
And if caching fails, shouldn't BAck be sent back to the Home Address (without RH, 
and tunnelled by HA to MN)?

Please correct me if I'm wrong. 

Regards,
Vrizlynn Thing (Ms)

---

From: Jari Arkko <[email-masked]>
Date: Wed, 07 Aug 2002 13:49:43 +0300

> Is this referring to the Type 0 or 2 RH?

Type 2. See a separate thread on removing some references to addresses
allowable in RH. The remaining RH references should state type 2 in
all cases. That is, in your specific example the text should
have read:

   "if the packet is to be sent to the mobile node at any address other than the mobile
   node's home address, it MUST be sent using a Type 2 Routing header...

> If the "addresses other than Home Address" is referring to the Care-of 

I believe it refers to the source address of the BU. Let's clarify the
text as follows:

  Furthermore, if the packet
  is to be sent to the mobile node at any address other than the mobile
  node's home address, ...

=>

   The acknowledgement is sent to the Source Address of the IPv6 header
   that carried the Binding Update. If this address is different from
   the home address of the mobile node, ...

I registered the above modifications as issue #95.

> in Section 9.6: Sending Packets to a MN)?

Yes.

> and tunnelled by HA to MN)?

For CNs, I think it makes more sense to send the packet to the source
address of the BU if possible. This would avoid some reflection attacks
that would otherwise become possible. As Vijay pointed out, this does
not apply to HAs so the HA would still be able to respond to the home
address.

Jari

---

From: Vrizlynn Thing <[email-masked]>
Date: Thu, 08 Aug 2002 09:54:15 +0800

> not apply to HAs so the HA would still be able to respond to the home

I agree with the above. Let's say we have 3 cases here.

Case 1: BU accepted for caching
src = CoA
dest = CN

BAck sent with src = CN, dest = CoA, RH2 = HoA

Case 2: BU accepted for deletion (lifetime == 0)
src = HoA
dest = CN

BAck sent with src = CN, dest = HoA
If src in BU is not HoA but legal RH address, then BAck dest = this src
address, RH2 = HoA

Case 3: BU not accepted
src = CoA / HoA / other addresses
dest = CN

BAck sent with src = CN, dest = HoA
If src in BU is not HoA but legal RH address, then BAck dest = this src
address (no RH2 in this case since binding not accepted)

Am I right to say these? I voiced out these questions mainly because in
Sect. 9.4.4 (Sending Binding Acknowledgement), it's stated that
RH should contain either CoA or Src address. Whereas, I believe in any cases
if RH is to be used, it should contain HoA instead.

Regards,
Vrizlynn Thing

---

From: Jari Arkko <[email-masked]>
Date: Thu, 08 Aug 2002 14:11:40 +0300

> BAck sent with src = CN, dest = CoA, RH2 = HoA

Right.

> address (no RH2 in this case since binding not accepted)

No. Per issue #92 CNs will not respond to HoA if the src is unsuitable.

So: 

   BAck sent with src=CN, dest=bu src, RH2=hoa

I think this applies to both cases 2 and 3. The real differentiator is
is (1) whether bu src is equal to home address or not, and then if
not (2) whether the bu src is a suitable address or not.

> if RH is to be used, it should contain HoA instead.

Correct. This should be fixed.

Sigh... 9.4.4. is a continuous source of trouble... let's try to
create better text to fix #92, #94 and #95. This one is for 9.4.4:

   The acknowledgement is sent to the Source Address of the IPv6 header
   that carried the Binding Update. Note that this procedure is
   independent from the treatment of regular packets and does not use
   information from the Binding Cache.

   If the Source Address field does not contain a global unicast address,
   the Binding Acknowledgement MUST NOT be sent.

   If the address is a global unicast address, further processing
   depends on whether this address is the home address of the mobile node
   or not. If the Binding Update does not contain a Home Address destination
   option, then the source address is the home address of the mobile
   node. If so, the Binding Acknowledgement MUST be sent directly to this address.
   Otherwise, the Binding Acknowledgement MUST still be sent to the source address,
   but a Type 2 Routing Header MUST be added to the packet to carry the
   home address.

And this one is for 10.2:

   The acknowledgement is sent to the Source Address of the IPv6 header
   that carried the Binding Update. Note that this procedure is
   independent from the treatment of regular packets and does not use
   information from the Binding Cache.

   If the Source Address field does not contain a global or link-local
   unicast address, the Binding Acknowledgement MUST NOT be sent.

   If the address is of these types, further processing
   depends on whether the address was the home address of the mobile node
   or not. If the Binding Update does not contain a Home Address destination
   option, then the source address is the home address of the mobile
   node. If so, the Binding Acknowledgement MUST be sent directly to this address.
   Otherwise, the Binding Acknowledgement MUST still be sent to the source address,
   but a Type 2 Routing Header MUST be added to the packet to carry the
   home address.

Jari

---

From: Erik Nordmark <[email-masked]>
Date: Fri, 9 Aug 2002 14:27:12 +0200 (CEST)

> address (no RH2 in this case since binding not accepted)

The safe thing to do (to avoid using this for reflection attacks) in
this case is to send the BAck with a destination which is the source of the BU.

  Erik

---

From: Erik Nordmark <[email-masked]>
Date: Fri, 9 Aug 2002 14:30:00 +0200 (CEST)

> not (2) whether the bu src is a suitable address or not.

While this packet doesn't cause reflection attacks in case 3
(since it is delivered to the bu src) it seems a bit odd to have 
the RH2 there. Doesn't cause harm as far as I can tell mbut it looks odd...

  Erik

---

From: Jari Arkko <[email-masked]>
Date: Fri, 09 Aug 2002 15:47:17 +0300

> the RH2 there. Doesn't cause harm as far as I can tell mbut it looks odd...

The rules that I'm proposing (see bottom of [1]) sends the BA
always to the BU src (and drops it if the src is unsuitable). RH2
goes to the packet when the src is not the home address.

Are you saying that you'd like RH2 to be included only if (a) the
BU src is not the home address AND (b) the BU has been successful?

Jari

[1] http://www.piuha.net/~jarkko/publications/mipv6/issues/issue95.txt