Subject: Re: [MOBILE-IP] Comment Please: Placement for Home Address option header

From: Richard Draves <[email-masked]>
Date: Mon, 20 Nov 2000 08:31:28 -0800

> => do you propose to change all IPsec implementations?

Adding mobile node support will require some change to all implementations.
It's a question of how much changes. For your implementation, you're saying
that allowing the Home Address option to appear after the IPsec headers will
require substantial change. For my implementation (and Markku's
implementation), it does not require much change.

> => lazy-evaluation is not an option if you'd like to support
> the multiple
> IPsec header case.

Not true. Again, I have an existence proof.

> => I never say it is not possible but it is not RFC 2401 compliant
> (not a real problem if you keep the behavior without new
> security issues)
> and this is *not* the way existent implementations (with one
> exception) work.

I think it is compliant. And more than one implementation works this way.

>
>    I understand that your implementation doesn't work this way
>
> => KAME implementation what I use doesn't check the source address
> (I don't matter because I have disable the tunnel mode)...
>
>    and that you don't care to change it.
>
> => ask Itojun (:-). I am afraid that near all implementors
> won't care to
> change their implementation when there is a simpler and
> cleaner solution.

I think there's some debate what is "simpler and cleaner".

>
>    If that's the basis for your argument, you should say so
>    - appealing to RFC 2401 won't work.
>
> => please bring the discussion to the IPsec mailing list. I'd like to
> get the rationale for this section of RFC 2401 (and some others).
>

---

From: Francis Dupont <[email-masked]>
Date: Fri, 24 Nov 2000 14:36:48 +0100

=> the purpose of the mobile IPv6 specs is to require minimal changes
(as for any new specs).

   It's a question of how much changes. For your implementation, you're saying
   that allowing the Home Address option to appear after the IPsec headers will
   require substantial change.

=> no, I am saying this will require substantial change to all the
implementations I have read the code (KAME, NRL, OpenBSD, FreeS/WAN) with
the exception of KAME (more because KAME is not very compliant than
because of a clever implementation :-). I have no access to proprietary
source codes then I've posted the question in the IPsec mailing list...

   For my implementation (and Markku's
   implementation), it does not require much change.

=> 2 examples (or 4) are not enough to have a good idea of the common
practice (or of the rationale behind RFC 2401).

=> have you tried your code with multiple IPsec headers, for instance
an AH followed by an ESP (with confidentiality, a common combinaison)?
I'd like to know you can get the home address from a header in a ciphered
payload...

[email-masked]

PS: the discussion is moving to the IPsec mailing list.