Subject: RE: [mobile-ip] question on protecting MN - HA communication

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 15 Oct 2002 10:01:22 -0700

Vijay,

If we go by the IETF maxim "be liberal in what you accept", I am not
sure whether we can drop the packet :-)

From your original email, 

IPv6 header (source = care-of address, destination = home agent)
   Dst Opts Hdr
      HAO
   ESP header
   IPv6 header (source = home address, destination = correspondent node)
   Mobility Header
      Home Test Init

We want to disallow this format on the wire i.e., whenever a packet is
tunneled to the home agent, HAO is not useful at all, so why add it ?
If we don't look at the implementation details, this sounds reasonable
to me. But this is the format used by the original MIPv6 draft as far
as I can tell. It was not clearly documented but the details about
processing the HAO before processing the Ipsec etc. would indicate that.
So, there might be already some implementations doing
this. Don't you think we would be better off documenting this instead
of disallowing this ?

-mohan

> -----Original Message-----
> From: Vijay Devarapalli [mailto:[email-masked]] 
> Sent: Monday, October 14, 2002 5:31 PM
> To: Mohan Parthasarathy
> Cc: [email-masked]
> Subject: Re: [mobile-ip] question on protecting MN - HA communication
> 
> 
> > Mohan Parthasarathy wrote:
> 
> > What will the HA do if it receives the format not specified in the 
> > document ?
> > 
> 
> drop it!?
> 
> I am open to suggestions.
> 
> Vijay
>

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 15 Oct 2002 11:13:41 -0700

> this. Don't you think we would be better off documenting this instead

IMO, it does not fit into the draft. the draft assumes an IPsec
tunnel interface between MN and HA, with SPDs based on this 
tunnel interface.

moreover, the ESP header cannot protect the HAO destionation 
options header.

it would be better to leave it out.

Vijay