Subject: [shim6] Unknown destination locator [was: WG Last Call for draft-ietf-shim6-multihome-shim-api]

From: Shinta Sugimoto <[email-masked]>
Date: Wed, 23 Dec 2009 01:37:10 +0800

Hi all,

As pointed out by HIP experts (Thomas and Miika), we need to consider exceptional case for HIP when the application sets unknown destination locator for the socket.  Such an exceptional handling will allow application to provide the destination locator to the HIP.

1. The multihoming shim sub-layer checks if address family of the socket is AF_INET6 (all the SHIM6 cases would fall into this case).  If so, the shim must reject the request.
2. Otherwise, the shim checks if there is any multihome shim context associated with the socket.  If there is any, the shim must reject the request.
3. If there is none, and the multihome shim sub-layer turns out to be HIP, the shim SHOULD accept the request (accordingly, the shim being HIP implementation will probably initiate HIP basic exchange by sending I1 packet to the requested locator)

Does the above make sense?  Please comment.

Regards,
Shinta

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 23 Dec 2009 08:34:25 +1300

Cases 1 and 3 make sense to me. Maybe for case 2 it should be SHOULD
reject the request (because we might have some future shim design
that works differently). Or add a note that the rules may need to be
modified for some future shim design.

Thanks
   Brian

On 2009-12-23 06:37, Shinta Sugimoto wrote:
> _______________________________________________
> shim6 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/shim6
>

---

From: Shinta Sugimoto <[email-masked]>
Date: Thu, 24 Dec 2009 02:20:30 +0800

Hi Brian,

Thank you for your comment.  I see and your suggestion sounds reasonable to me.  Let us state that the shim SHOULD reject the request in the second case.

Regards,
Shinta 

> -----Original Message-----
> From: Brian E Carpenter [mailto:[email-masked]] 
> Sent: Wednesday, December 23, 2009 4:34 AM
> To: Shinta Sugimoto
> Cc: [email-masked]
> Subject: Re: [shim6] Unknown destination locator [was: WG 
> Last Call for draft-ietf-shim6-multihome-shim-api]
> 
> Cases 1 and 3 make sense to me. Maybe for case 2 it should be 
> SHOULD reject the request (because we might have some future 
> shim design that works differently). Or add a note that the 
> rules may need to be modified for some future shim design.
> 
> Thanks
>    Brian
> 
> > As pointed out by HIP experts (Thomas and Miika), we need 
> to consider exceptional case for HIP when the application 
> sets unknown destination locator for the socket.  Such an 
> exceptional handling will allow application to provide the 
> destination locator to the HIP.
> > 
> > 1. The multihoming shim sub-layer checks if address family 
> of the socket is AF_INET6 (all the SHIM6 cases would fall 
> into this case).  If so, the shim must reject the request.
> > 2. Otherwise, the shim checks if there is any multihome 
> shim context associated with the socket.  If there is any, 
> the shim must reject the request.
> > 3. If there is none, and the multihome shim sub-layer turns 
> out to be 
> > HIP, the shim SHOULD accept the request (accordingly, the 
> shim being 
> > HIP implementation will probably initiate HIP basic exchange by 
> > sending I1 packet to the requested locator)
> >

---

From: "Henderson, Thomas R" <[email-masked]>
Date: Wed, 23 Dec 2009 14:40:44 -0800

> > > sending I1 packet to the requested locator)

Would it be clearer to just restrict the scenario of "Unknown locator" to shim6?  I think the main issue with unknown locators is security in shim6.  For HIP, I don't think it matters so even in case 2 above, I think that HIP shim should accept the request unless such locator violates some other policy restriction in HIP.  As the above reads now, it seems to me that it is saying that HIP should reject an unknown locator after the HIP handshake was completed.

Tom

---

From: Miika Komu <[email-masked]>
Date: Mon, 28 Dec 2009 15:31:11 +0100

Henderson, Thomas R wrote:

Hi,

>>> -----Original Message----- From: Brian E Carpenter
>>> [mailto:[email-masked]] Sent: Wednesday, December
>>> 23, 2009 4:34 AM To: Shinta Sugimoto Cc: [email-masked] Subject:
>>> Re: [shim6] Unknown destination locator [was: WG Last Call for
>>> draft-ietf-shim6-multihome-shim-api]
>>> 
>>> SHOULD reject the request (because we might have some future shim
>>> design that works differently). Or add a note that the rules may
>>> need to be modified for some future shim design.
>>> 
>>> Thanks Brian
>>> 
>>> to consider exceptional case for HIP when the application sets
>>> unknown destination locator for the socket.  Such an exceptional
>>> handling will allow application to provide the destination
>>> locator to the HIP.
>>> of the socket is AF_INET6 (all the SHIM6 cases would fall into
>>> this case).  If so, the shim must reject the request.
>>> shim context associated with the socket.  If there is any, the
>>> shim must reject the request.
> Would it be clearer to just restrict the scenario of "Unknown
> locator" to shim6?  I think the main issue with unknown locators is
> security in shim6.  For HIP, I don't think it matters so even in case
> 2 above, I think that HIP shim should accept the request unless such
> locator violates some other policy restriction in HIP.  As the above
> reads now, it seems to me that it is saying that HIP should reject an
> unknown locator after the HIP handshake was completed.

I agree with Thomas. I think the suggested change is too strict when it
comes to HIP. Also, HIP can check unknown peer locators with return 
routability procedures after the base exchange is completed.

---

From: Shinta Sugimoto <[email-masked]>
Date: Wed, 30 Dec 2009 22:47:14 +0900

Hi Thomas and Miika,

sorry for the delayed repsonse. please find my comments below.

Miika Komu wrote:
>>>> reject the request (because we might have some future shim

Ok, let us relax the rule a bit for HIP then.

We will specify that the restriction in treatment of unknown 
*destination* locator is applied only to SHIM6.  Note that the treatment 
of unknown *source* locator is the same for SHIM6 and HIP.

Regards,
Shinta