Subject: Re: [MOBILE-IP] RFC2002 bis

From: "Kent K. Leung" <[email-masked]>
Date: Tue, 7 Mar 2000 21:54:27 -0800

One area that's not covered by RFC2002bis is how Mobile Node
as well as Foreign Agent should deal with Mobile-Home Authentication
Extension (MHAE) when FA replies with error code.  There are 2 scenarios
when FA rejects registration: 1) FA denies registration request
(ie requested lifetime greater than advertised) and 2) FA sends
rejection when HA reply is bad (ie Foreign-Home Authentication
Extension check fails).  In either case, the authenticator in
Mobile-Home Authentication Extension is invalid when received by
MN.

So when registration is rejected by FA, the MN will silently
discard reply because authenticator is invalid.

Seems like some MN implementation skips MHAE if the error code
is from FA.  But then this can lead to bad guy sending rejections
even when registration being accepted by HA, maybe a little later.
One possible solution is that MN can believe rejection reply if
MFAE exists or after it allows enough time for reply from HA to arrive.

We need some more information in section 3.6.2.3 "Registration Request
Denied" in how Mobile Node handle denials from FA, section 3.7.2.3
"Denying Invalid Requests" and section 3.7.3 "Receiving Registration
Replies" in how FA deal with MHAE when generating a rejection reply.

-- Kent --

>
> It's important to turn this around quickly if we want it to replace 2002 and
> then move this from proposed standard to draft standard.  We discussed in
> Washington about the amount of work that will be involved from moving to
> proposed to draft and agreed that we should update 2002 while working on
> getting enough implementations to move to draft standard.  Getting the
> replacement done quickly would allow us to get to draft standard this year,
> hopefully.
>
> Phil

---

From: Yoshiyuki Tsuda <[email-masked]>
Date: Mon, 13 Mar 2000 20:46:58 +0900

Hello, Charlie and Kent,

 As Kent has already sent an email to this mailing-list, at the Connectathon,
 we found and agreed there was an unclear specification about replying an
 error by an FA to an MN, which would lead to an interoperability problem.
 I don't know wheather it should be specified in the 2002bis or it is
 described in aother draft.

 In case that an FA replys to an MN with error-code, I was once assuming as
 the followings:
 1) The FA creates an registration reply with a proper error-code.
 2) A dummy Mobile-Home Authentication extension, which may be copied from
    the received registration request, should be included in the above
    registration reply.
 3) If an MN receives such a registration reply, according to the error-
    code, the MN should skip checking the Mobile-Home Authentication
    extension.
 4) But, an MN should check there is only one Mobile-Home Authentication
    extension.

 Now, I have the following questions:
 a) Should a dummy Mobile-Home Authentication extension be included in such
    a reply ?  It is meaningless.  But, if an MN checks its existence, it
    must be included.
 b) May an MN skip checking a Mobile-Home Authentication extension in case
    of such an error-code ?  A man-in-the-middle problem may occur, if there
    is no SA between the FA and the MN.
 c) Should an MN check there is only one Mobile-Home Authentication extension
    in such a reply ?  If an FA doesn't include this extension, an MN will
    discard such a reply silently.

 I'd like to know some consensus to the above issue.

Thanks in advance.
-Yoshi