Subject: [mobile-ip] IPSEC problem with tunneling to CN via Home Agent?

From: Markku Savela <[email-masked]>
Date: Mon, 14 Apr 2003 11:30:13 +0300

I need clarification how tunneled packets are supposed to be protected
by IPSEC in following scenario

- MN away from home
- packets to CN are tunneled via home agent

Unless I'm seriously misread something, the packets look as follows at
MN:

     MN -> HA         HA -> MN
     --------         --------     
 IP: dst=HA           dst=MN-car
     src=MN-care      src=HA
     IPSEC (AH/ESP)   IPSEC(AH/ESP)
 IP: dst=CN           dst=MN-home
     src=MN-home      src=CN
     Payload          Payload

Above works just fine with existing IPSEC implementations, if the SA's
are created between HA and care-of address.

However, draft-ietf-mobileip-mipv6-ha-ipsec-04.txt, although not quite
clear, seems to hint SA's between HA and home address. THIS will not
work with any currently installed standard IPSEC/IKE base, unless you
change the above packets formats into:

     MN -> HA         HA -> MN
     --------         --------     
 IP: dst=HA           dst=MN-car
     src=MN-care      src=HA
     HAO: MN-home     RTH2: MN-home
     IPSEC (AH/ESP)   IPSEC(AH/ESP)
 IP: dst=CN           dst=MN-home
     src=MN-home      src=CN
     Payload          Payload

So which way it is?

a) no IPSEC with MIP6 until some future IPSEC version is installed and
available?

b) change the packet formats as indicated, or

c) use the first presented versions, but make SA's between CARE
address and HOME agent?

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 14 Apr 2003 09:24:34 -0700

Markku Savela wrote:
> clear, seems to hint SA's between HA and home address. 

it is a tunnel mode SA. the selector match is done on the
inner header. the outer header is formed when you add 
the IPsec tunnel.

from draft-ietf-mobileip-mipv6-ha-ipsec-04.txt

>   o  When IPsec is used to protect return routability signaling or
>       payload packets, the security policy database entries SHOULD be
>       defined specifically for the tunnel interface between the mobile
>       node and the home agent.  That is, the policy entries are not
>       generally applied on all traffic on the physical interface(s) of
>       the nodes, but rather only on traffic that enters this tunnel.

I always like to draw a figure when explaning this....

     host1--------SG1=============SG2--------host2

SG1 and SG2 are IPsec gateways, protecting traffic from host1 
to host2 with an ESP tunnel.

in MIPv6

     MN===========================HA---------CN

host1 and SG1 collapse into the same node. SG2 is HA.

Vijay

---

From: Markku Savela <[email-masked]>
Date: Mon, 14 Apr 2003 20:23:13 +0300

> From: Vijay Devarapalli <[email-masked]>
> > 

Right, but that is not the problem I was trying to present. With
current IPSEC, tunnel mode SA's are based on addresses on the OUTER
HEADER, and this is quite correct IMHO! (although, as you say,
selectors match the inner ones).

If MIPv6 says SA's are based on Home Address/Home Agent addres, then
one *could* try force the mobile node into trying to negotiate
outgoing SA using

  SA-OUT: src=HomeAddress dst=Home Agent

HOWEVER, IKE negotiates symmetric SA's, thus the incoming SA would be

  SA-IN: src=HomeAgent dst=HomeAddress

Now look at the incoming packet from HA

     dst=MN-care
     src=HA
     IPSEC(AH/ESP)
     dst=MN-home
     src=CN
     Payload

as per IPSEC specificication, the SA used MUST have dst=MN-care, but
there is no such SA! Thus, packet gets dropped!

(the problem could easily fixed by adding RTH2(HomeAddress) or using
care address instead of HomeAddress), as was my one suggestion.

Some might say that solution is to change IPSEC. I'm not so sure it is
wise. But, if you insist, then I suppose you would want SA-IN(src=HA,
dst=*).

I believe there is such change at least proposed to the IPSEC core,
but on HA the same SA would be presented as

  SA-OUT: (src=HA, dst=*)

which looks a bit fishy, considering that it would need one of these
for each MN. How does it differentiate them when choosing one for
outgoing MN traffic?

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 14 Apr 2003 10:59:57 -0700

Markku Savela wrote:
> HEADER, and this is quite correct IMHO! 

there is only field in the SA called the source address. 
and there is only one field in the SA called the 
destination address. and these fields have to match the 
source and destination address of the inner IPv6 header. 
*not* the outer IPv6 header.

> (although, as you say,

check RFC 2401

>    Mapping the IP datagram to the appropriate SA is simplified because
>    of the presence of the SPI in the AH or ESP header.  Note that the
>    selector checks are made on the inner headers not the outer (tunnel)
>    headers.

this has been made more explicit in draft-ietf-ipsec-esp-v3-05.txt

> there is no such SA! Thus, packet gets dropped!

you only need the SPI (in addition to the IPsec protcol)
to do the lookup for incoming packets. you shouldnt be 
using the destination address on the outer tunnel in the 
SA lookup for the incoming packet. section 2.1 and section 
3.4.2 of draft-ietf-ipsec-esp-v3-05.txt make it clear that 
you only need the SPI for the SA lookup for incoming packets.

> care address instead of HomeAddress), as was my one suggestion.

there was a long debate on the mailing list on this. it was
called the optimized format Vs non-opimized format. it was
decided to go with the optimized format.

Vijay