Subject: Re: [MOBILE-IP] Comment Please: Placement for Home Address option header

From: Richard Draves <[email-masked]>
Date: Fri, 10 Nov 2000 12:09:16 -0800

> I have looked at 4 free implementations:
>  - all of them don't use the source address for the SA lookup
>  - two of them do the check of the source address at the end of
>    the SA lookup then the source address must be available (ie.
>    the header with the home address option must be before the first
>    IPsec header)
>  - only one of them don't check the source address after the
> processing
>    of a IPsec header in transport mode
> Conclusion: if the home address is not available after the processing
> of *each* IPsec header then we'll kill near all IPsec implementations
> (ie. someone will say we'll kill all compliant implementations), if
> it is not available before any IPsec header then we'll kill
> all paranoic
> implementations (at least one half IMHO).

There are implementations for which this conclusion is not true.

I think the best approach is to figure out what is the right thing for the
protocol, and then implementors should implement it. Your approach seems to
be to look at what a few particular implementations do and then base the
protocol on that. Seems backwards.

Rich

---

From: Francis Dupont <[email-masked]>
Date: Tue, 14 Nov 2000 12:27:15 +0100

=> yes, the point is how to interpret the RFC 2401 and to look at current
implementations seems a good way to know past interpretations (including
one by the author of the RFC).

   I think the best approach is to figure out what is the right thing for the
   protocol, and then implementors should implement it.

=> I agree but this is true only for the mobile IPv6 part, not the IPv6
or IPsec parts even we can complain they are not perfect (enough).

   Your approach seems to
   protocol on that.

=> I just like to understand what is the current practice for SA selector
checks because the RFC 2401 is not very clear (at least no enough to avoid
this discussion). The conclusion is a strict interpretation is valid
(and they are even stricter interpretations in the real world) then
anything based on a loose interpretation will fail.

   Seems backwards.

=> do you prefer to lose some months in the IPsec mailing list to clarify
in your way the RFC 2401 and then to modify a large part of current IPsec
implementations? I don't think so.

Regards

[email-masked]

PS: I don't believe nothing should be done but there is a working solution
today then we should adopt it *now* and keep the door open.