Subject: [mobile-ip] How to handle RoutingHeader Type zero

From: "Greg O'Shea" <[email-masked]>
Date: Fri, 30 Aug 2002 16:25:30 +0100

Draft 18 sections 4.1, 9.6, 11.2.3 and 14.7 explain why type 2 routing
headers are a good idea and how they should be validated. But the spec
does not say what the MN must do if a RH type 0 is received where a RH
type 2 is expected. As I read things (strictly) a type zero with a
LastSeg=HoA could go all the way through with less validation than a
type 2.

---

From: "Greg O'Shea" <[email-masked]>
Date: Fri, 30 Aug 2002 18:31:31 +0100

If a type zero gets through the filters then it's not obvious why the MN
need reject the packet, except perhaps that the final segment might not
be to a HoA which the MN isn't required to check for a type zero.

Section 9.6 seems to leave open the possibility that a type zero RH will
be sent by a CN ("For example, assuming ... if no other use...") but
Section 11.2.3 assumes that a MN will never receive a routing header
other than type 2.

Can anyone clarify the intent?

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] 
>Sent: 30 August 2002 16:37
>To: Greg O'Shea; [email-masked]
>Subject: RE: [mobile-ip] How to handle RoutingHeader Type zero 
>
>
>
>From: 
>http://www.piuha.net/~jarkko/publications/mipv6/security-consid
erations-new.txt
>"
>15.7      Type 2 Routing Header
>
>The definition of the Type 2 Routing Header is described in 
>Section 6.4. This definition and the associated processing 
>rules have been chosen so that the header can not be used for 
>what is traditionally viewed as source routing. In particular, 
>the IPv6 the Home Address in the routing header will always 
>have to be assigned to the home address of the receiving node. 
>Otherwise the packet will be dropped.
>
>Generally, source routing has a number of security concerns. 
>These include the automatic reversal of unauthenticated source 
>routes (which is an issue for IPv4, but not for IPv6). Another 
>concern is the ability to use source routing to "jump" between 
>nodes inside, as well as outside a firewall. These security 
>concerns are not issues in Mobile IPv6, due to the rules 
>mentioned above.
>
>In essence the semantics of the type 2 routing header is the 
>same as a special form of IP-in-IP tunneling where the inner 
>and outer source addresses are the same.  This implies that a 
>device which implements filtering of packets should be able to 
>distinguish between a Type 2 Routing header and other Routing 
>headers, as required in section 8.3. This is necessary in 
>order to allow Mobile IPv6 traffic while still having the 
>option to filter out other uses of Routing headers. "
>
>So are you suggesting that the spec make a recommendation that MNs 
>MUST NOT process packets with RH type 0?
>
>>