Subject: Re: [Autoconf] Autoconf Digest, Vol 25, Issue 10

From: "Hasnaa Moustafa" <[email-masked]>
Date: Thu, 21 Feb 2008 16:22:05 +0100

Hi Teco,

I agree with you on considering something about the authorization. You
proposed in your mail below the following text to elaborate R11 " Solutions
must comply with authorization mechanisms validating access to external
networks.".

IMHO, this fits more under R10 related to the security issue. What do you
think of this text as R10.1 "Solutions must allow IP addresses/prefixes
assignment to only authorized nodes"? And this requriement applies only when
there is a connection with external networks (we do not need to mention that
explicitly) since R14 says that the requirements applications are scenario
specific.

Kind Regards,
Hassnaa
------------------------------
Date: Thu, 21 Feb 2008 12:13:14 +0100
From: "Teco Boot" <[email-masked]>
Subject: Re: [Autoconf] AUTOCONF Problem Statement: reviews needed.
To: "'Emmanuel Baccelli'" <[email-masked]>
Cc: [email-masked]
Message-ID: <00b001c8747a$c06adc80$41409580$@nl>
Content-Type: text/plain;       charset="iso-8859-1"

Hi, Comments inline.
Regards, Teco

> -----Oorspronkelijk bericht-----
> Van: [email-masked] [mailto:[email-masked]]
> Namens Emmanuel Baccelli
> Verzonden: donderdag 21 februari 2008 11:13
> Aan: [email-masked]
> Onderwerp: Re: [Autoconf] AUTOCONF Problem Statement: reviews needed.
>
> Hi Teco,
>
> Teco Boot a ?crit :
> > Hi Emmanuel, WG chairs,
> >
> > I posted some of my "additional" thoughts on the PS document. There
> was some
> > discussion, maybe we can come up with an outcome:
> >
> > 1) Need for active DAD.
> > Not that much response yet. It is a comment on the Autoconf PS text.
> Add a
> > single line at the end of 5.2.2?
> > Proposed text:
> >>   Also the Duplicate Address Detection signalling could
> >>   introduce unacceptable overhead.
> > Text is in line with text above in section 5.2.2 and in line with
> RFC4862.
> >
>
> I guess your argument basically says "NDP is not optimized", but it
> does
> not say: "NDP does not work". I agree you have a point, but for now the
> document concentrates on why "NDP does not work", and it is explained
> in
> section 5.2.2.
>
> Furthermore, in section 6.1, solutions requirements (i.e. R06) state
> that "solutions must achieve low overhead". So I guess that your
> concern
> is covered anyways. Do you agree?
[Teco:]
R06 is OK, this req is important.
The proposed text mentions a problem with usage of NDP DAD in a wireless
network were overhead is a concern. The problem is directly related to NDP.
Therefore I liked to mention this explicitly.

> > 2) Multi-homed subordinate MANETs and source address selection and
> session
> > continuity.
> > This is an important real-world problem that must be addressed
> somewhere.
> > However the problem is a result of what Autoconf and MANET achieves,
> so
> > input for a follow-up. I can live with an outcome that the Autoconf
> WG
> > produces a separate document describing this scenario and introduced
> > problem(s). I can present the scenario and the introduced problem(s)
> in
> > Philly. I did in Chicago, but there were few seconds left for my
> > presentation, and I think many of us may not understood the scenario
> and the
> > introduced problem(s).
> > What do you think?
>
> In section 6.1., solutions requirements (i.e. R11) state that
> "solutions
> should work in MANETs connected to external network(s), via multiple
> border routers." Does this take into account your concern? If not, how
> do you suggest we alter this requirement to take it into account?
[Teco:]
Req11 is OK, but very general. And it is a should, not a must.
Add R 11.1.?
**> Solutions must circumvent problems with source address filtering
**> on ingress to external networks.
The problems with multiple external networks are not described in current PS
document. The discussion on ML made also clear the problem is not well
understood.
I'll wait for a reaction from chairs on where to describe the problems.

Simone mentioned that the performance degradation caused by non-optimal
prefix choice is not tackled anywhere.
Add R 11.2.?
**> Solutions should select addresses and prefixes to optimize communication
**> to external networks.

> > 3) Authorization to use access to external network.
> > This is also an important real-world problem that must be addressed
> > somewhere. Similar to problem 2, it is a problem that is introduced
> as a
> > result of what Autoconf and MANET achieves. We could describe this
> problem
> > in more detail in the scenario document I suggested above.
> >
>
> Again, do you think R11 covers this? Or how do you suggest we alter it?
[Teco:]
Here I don't think R 11 addresses the problem.
Add R 11.3.?
**> Solutions must comply with authorization mechanisms validating access to

**> external networks.

>
> Emmanuel
>
> > Can the WG chairs can react on my proposal?
> > Opinion from ADs?
> >
> > Regards, Teco
> >
> >
> >
> _______________________________________________
> Autoconf mailing list
> [email-masked]
> http://www.ietf.org/mailman/listinfo/autoconf

------------------------------

_______________________________________________
Autoconf mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/autoconf

End of Autoconf Digest, Vol 25, Issue 10
****************************************
_______________________________________________
Autoconf mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/autoconf

---

From: "Teco Boot" <[email-masked]>
Date: Thu, 21 Feb 2008 16:39:16 +0100

Hi Hassnaa,

I think the section 7 security threats are different than authentication /
authorization for access to external networks.

And the problem we discuss right now is about assigning an address or prefix
that is associated with an external network, but traffic to this external
network could be blocked because the AAA procedure was not performed. For
this reason, I prefer the requirement on R 11, which is about MANETs
connected to external network(s).

Secure communication within a MANET is a different problem. I am not sure
what Autoconf WG should do at this moment. For example, protecting MANET
Routing protocol is a task for MANET WG. Problems with SeND (used in an ad
hoc network) could be a problem for Autoconf, if ND is to be used. 

Regards, Teco

Van: Hasnaa Moustafa [mailto:[email-masked]] 
Verzonden: donderdag 21 februari 2008 16:22
Aan: Teco Boot
CC: [email-masked]
Onderwerp: Re: Autoconf Digest, Vol 25, Issue 10

Hi Teco, 

Kind Regards,

Hassnaa