Subject: RE: [mobile-ip] RFC3012-bis question

From: "Woojune Kim" <[email-masked]>
Date: Wed, 29 Jan 2003 19:17:01 -0500

Jayshree,

I guess you are saying it depends on how you understand sec 3.2. 

".. sec 3.2 ...
Also in this case, the Foreign Agent MUST reject any Registration Reply message coming from the Home Agent that does not also include the Challenge Extension with the same Challenge Value that was included in the Registration Request.  
.."

Your explanation seems to imply that the above sentence means something like 

IF (the Reply contains a Challenge Extension)
	 it must be rejected if it does not match the challenge value that 
       had been included in the reg request
ELSE
	just process as normal reply
END 

If that is the case, then I think the sentence should be clarified to state it in that manner.

thanks

Woojune

-----Original Message-----
From: Jayshree Bharatia [mailto:[email-masked]]
Sent: Wednesday, January 29, 2003 7:07 PM
To: Woojune Kim
Cc: [email-masked]
Subject: RE: [mobile-ip] RFC3012-bis question 

There are two cases we are dealing with 1)  Challenge received with a different Challenge value than the one sent to the HA in a Registration Request and 2) Challenge not received from the HA in a Registration Reply.
The text in section 3.2 (regarding sending of MISSING-CHALLENGE) refers to case 1 only. 
  
The case 2 will not be a reject scenario like case 1. As per section 3.4, the HA sends Registration Reply to the FA without Challenge extension in it even if it doesn't recognize the Challenge extension. Section 3.3 mentions that the FA should include a new challenge extension in any Registration Reply, successful or not. This is mainly for the backward compatibility.
 
Regards, 
Jayshree 
> -----Original Message----- 
> From: Woojune Kim [mailto:[email-masked]] 
> Sent: Wednesday, January 29, 2003 5:10 PM 
> To: [email-masked] 
> Subject: [mobile-ip] RFC3012-bis question 
> 
> 
> Hi, 
> 
> I've been reading RFC3012-bis-v4 and found something that 
> doesn't seem to fit (at least in my mind). Please enlighten me. 
> 
> Near the end of  Sec 3.2, it says 
> 
> " .. 
>    If the Foreign Agent does not remove the Challenge extension, then 
>    the Foreign Agent SHOULD store the Challenge value as part of the 
>    pending registration request list [7].  Also in this case, the 
>    Foreign Agent MUST reject any Registration Reply message 
> coming from 
>    the Home Agent that does not also include the Challenge Extension 
>    with the same Challenge Value that was included in the Registration 
>    Request.  The Foreign Agent MUST send the rejected Registration 
>    message to the mobile node, and change the status in the 
> Registration 
>    Reply to the Code value MISSING_CHALLENGE (see section 10). 
> .." 
> 
> Now this seems to imply that if the FA decides to keep the 
> challenge ext in the RRQ it forwards to the HA, it expects 
> the HA to return it in the Reply, and notify the MN of this 
> fact with the MISSING_CHALLENGE value. 
> 
> But if you look at what the MN does when it receives a 
> MISSING_CHALLENGE in sec 3.1 
> 
> ".. 
>    MISSING_CHALLENGE: A Mobile Node that does not include a Challenge 
>    when the Mobile-Foreign Authentication extension is present may 
>    receive a MISSING_CHALLENGE error.  In this case, the Mobile Node 
>    SHOULD send an unused Challenge extension in the next Registration 
>    Request. 
> .." 
> 
> So presumably the MN will again send a RRQ with a challenge extension. 
> 
> Assuming the FA and HA act in the same manner as before, we 
> get into a loop. 
> 
> Now the root cause is the HA returns a RRP without a 
> challenge extension when the FA is expecting one. But can the 
> HA ever return a RRP without a challenge ? Again in Sec 3.4 it says .. 
> 
> " .. 
>    Since the extension type for the Challenge extension is within the 
>    range 128-255, the Home Agent MUST process such a Registration 
>    Request even if it does not recognize the Challenge extension [7]. 
>    In this case, the Home Agent will send a Registration Reply to the 
>    Foreign Agent that does not include the Challenge extension. 
> .." 
> 
> Assuming the HA doesn't understand the challenge extension, 
> it will ignore it, presumably make a correct RRP and send it 
> back to the FA. But, as it doesn't understand the challenge 
> extension, it will NOT be included in the RRP. 
> 
> So, the end result is that it looks like we have the 
> potential to get into a infinite loop. 
> 
> Am I missing something basic here ? 
> 
> thanks 
> 
> Woojune 
> 
>

---

From: Sivasundar Ramamurthy <[email-masked]>
Date: Wed, 29 Jan 2003 16:46:15 -0800 (PST)

> ".. sec 3.2 ... Also in this case, the Foreign Agent MUST reject
> any Registration Reply message coming from the Home Agent that
> does not also include the Challenge Extension with the same
> Challenge Value that was included in the Registration Request.  
> .."
> 
 
I agree that this should be stated clearly.

Until Jayashree's email, I too interpreted this sentence as
"missing extension or mismatch challenge value in extension," and
not as "mismatch challenge value in the (optional) challenge
extension."

Siva

---

From: Yoshiyuki Tsuda <[email-masked]>
Date: Thu, 30 Jan 2003 18:13:04 +0900

Hi folks,

 Sorry for my late reply.  Looking from a mobile node, my
 understanding of the 3.1 MISSING_CHALLENGE is as follows:
 - When a mobile node receives MISSING_CHALLENGE, and only if
   it didn't include a challenge in the previous registration
   request, it will include an unused challenge and re-send a
   registration request to the foreign agent.

 Therefore, it won't re-send a registration request when it
 receives the second MISSING_CHALLENGE, because, you know,
 the second registration request had already included a
 challenge.  Thus, such an infinite loop had been never
 experienced at the past bakeoffs.

 Well, a bad mobile node might keep sending registration
 requests each time it receives a MISSING_CHALLENGE.  So, a
 foreign agent had better prevent it, I agree.  Should we
 make clear of it ???

Thanks.
-Yoshi