Subject: RE: [nemo] RE: Issue 6

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Wed, 23 Jul 2003 09:23:32 +0100

> -----Original Message-----
> From: Vijay Devarapalli [mailto:[email-masked]]
> Sent: mardi 22 juillet 2003 23:07
> To: Pascal Thubert (pthubert)
> Cc: Jongkeun Na; Kent Leung (kleung); S. Felix Wu; [email-masked]
> Subject: Re: [nemo] RE: Issue 6
> 
> "Pascal Thubert (pthubert)" wrote:
> >
> > Can't we just drop code 143 and accept the implicit whatever?
> >
> > There are at least 3 cases of implicit with different problems
> > associated:
> >
> > - static route: HA could check for a static route but it does not
> > control it. The admin may change it. Should we drop the binding
then?
> > - prefix table: source of our recent discussion on how it compares
with
> > other IGPs
> > - dynamic route: HA does not have the associated routes yet. No clue
if
> > there will eventually be one? Should we drop the binding if none
come
> > up?
> >
> > You see code 143 is tricky to use for not much added value.
Sugestion,
> > get rid of the last paragraph and if the code. In implicit mode, the
HA
> > does its best and that's it.
> 
> I disagree. it is always good to have an error message
> if something goes wrong. the MR shouldnt assume the HA
> has setup forwarding for the Mobile Network, when the
> HA actually didnt. the MR has now way of figuring out
> whats wrong, if packets from the CN to MNNs are dropped
> at the HA.

Then you do not want implicit mode at all. Because even if the HA has
some prefixes listed for that MR in its prefix table, the may not be
correct, or complete. Unless the HA lists the prefixes it knows of in
the B-Ack. Again I'm talking about the real implicit, the one with
prefix table, as opposed to static routes or IGP over MRHA.

Consequence, if you want full checking, you need implicit, plus the list
of accepted prefixes in the B-Ack if not all.

In the latter case, (IGP over MRHA) the HA can not know at B-Ack time
whether it will ever get the right routes, or whether the MR will try
anything. So the code 143 is straight infeasible.

Pascal

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 23 Jul 2003 10:33:24 -0700

"Pascal Thubert (pthubert)" wrote:
> Then you do not want implicit mode at all. 

Pascal,

please read the text under implicit mode again.

    Implicit:

         In this mode, the Mobile Router does not include either a
         Mobile Network Prefix Option or a Mobile Network Prefix Length
         Option in the Binding Update (but it does include the Home
         Address Option in the Destination Options header, as all Mobile
         Hosts do).  The Home Agent can use any mechanism (not defined
         in this document) to determine the Mobile Network Prefix(es)
         owned the Mobile Router.  One of the possible mechanisms is
         where the Home Agent maintains a Pre-configured Prefix Table
         listing all the Mobile Network prefixes owned by a particular
         Mobile Router.  This table is keyed on the Home Address of the
         Mobile Router.

it says the Home Agent can use any mechanism. we suggest
Prefix Table as one of the mechanisms. static routes (as
you call them) is another mechanism. otherwise static
routes are not really mentioned anywhere in the spec.

> Because even if the HA has
> whether it will ever get the right routes, 

it doesnt have to. all it needs to do is lookup local
configuration to figure out if it is running a IGP 
with the mobile rputer. if the HA realizes it is not 
running an IGP, neither there is any information in
the prefix table, then it sends 143 status code in
the Binding Update if the MR sends a Binding Update
using implicit mode.

Vijay

> or whether the MR will try

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 23 Jul 2003 10:33:24 -0700

Pascal,

    Implicit:

Vijay

---

From: Alexandru Petrescu <[email-masked]>
Date: Thu, 24 Jul 2003 01:30:12 +0200

>          owned the Mobile Router.  One of the possible mechanisms is
                 ^by

>          where the Home Agent maintains a Pre-configured Prefix Table
                                             pre

>          Mobile Router.  This table is keyed on the Home Address of the

Couldn't this table in fact be the kernel routing table? It is true that
the kernel routing table is not keyed by the Home Address, and existing
lookup functions will compare with the prefix (not with the gw
address); but new functions can be written such as to search the routing 
table by the gw address instead (i.e. the MR Home Address).

So, either (1) the prefix table can be filled from the existing routing
table at bootup (it's 'pre-configured') or (2) the prefix table is not
used at all in implicit mode, the routing table is used instead: lookup
the Home Address of the Mobile Router and subsequently the associated
MNP and finally match the dst address of an incoming packet to MNP.

(Keeping in mind that the routing table entries to MNP through MR HoA
  MUST exist in the routing table when MR is at home.)

(The other suggestion against elimination of Prefix Table from implicit
mode is that the Prefix Table gives a sense of higher protection against
attacks, in that a Prefix Table gives the HA explicit knowledge of which
MNP is owned by which MR. Still, the very existence of routing table
entries towards MNP through MR HoA when MR is at home might already
constitute a sort of 'proof' for that ownership. I mean, if one doubts
the means by which that MNP entry got in the routing table in the first
place, one notices that it could have been by static routing; then it's
manual configuration: highest security. With dynamic routing, they have
their own security mechanisms, one of them being sharing keys (again
high security), others are dynamic keying (for which standards exist)
and also involve manual configuration of files. So, I would suggest that
existing means to configure the routing table with MNP and MR HoA is
already secure enough not to make one care about the need of a new
Prefix Table for implicit mode.)

> you call them) is another mechanism.

Ok that.  So maybe end of paragraph might be(?):

Another possible mechanism is where the Home Agent uses existing secure
forwarding information [entries in the kernel routing table that are
valid when the Mobile Router is at home] to find the association of
the Mobile Network Prefix to the corresponding Home Address.

I don't mean to interfere with your discussion, I'm just supporting
implicit mode without prefix table.

Alex
GBU

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 23 Jul 2003 15:04:27 -0700

Alexandru Petrescu wrote:
> MNP is owned by which MR. 

actually it does. dynamic routing protocols dont have 
explicit authorization built in. most are run using 
shared keys. these shared keys implicitly provide 
authentication and authorization.

Prefix table goes a step ahead and enables the HA to 
explicity check if a mobile router owns a particular 
prefix it is claiming.

> Still, the very existence of routing table
> manual configuration: highest security. 

agree.

> With dynamic routing, they have

:) there is some confusion again here. Prefix Table 
when used with implicit mode is not used for 
authorization. only in explicit mode it is used by 
the HA for the authorization check. infact the mobile 
router is not claiming any prefix in the implicit 
mode. it is only a mechanism by which the HA, in 
implicit mode, can use the entries in the prefix 
table to create routes at the HA. it *is* an 
alternative to creating static routes.

> the Mobile Network Prefix to the corresponding Home Address.

I am fine with adding this text. but note that this
is possible even with the existing text.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 23 Jul 2003 15:04:27 -0700

agree.

Vijay

---

From: Alexandru Petrescu <[email-masked]>
Date: Thu, 24 Jul 2003 01:30:12 +0200

^by

                                             pre

Alex
GBU

---

From: Alexandru Petrescu <[email-masked]>
Date: Thu, 24 Jul 2003 02:34:32 +0200

Vijay Devarapalli wrote:
>> (The other suggestion against elimination of Prefix Table from 
>> implicit mode is that the Prefix Table gives a sense of higher 
>> protection against attacks, in that a Prefix Table gives the HA 
>> explicit knowledge of which MNP is owned by which MR.
> 
> actually it does. dynamic routing protocols dont have explicit 
> authorization built in. most are run using shared keys. these shared
>  keys implicitly provide authentication and authorization. Prefix 
> table goes a step ahead and enables the HA to explicity check if a 
> mobile router owns a particular prefix it is claiming.

A-ha. I wonder why they didn't do it for routing protocols to allow
protection of which router can route update which prefix.

>> With dynamic routing, they have their own security mechanisms, one
>>  of them being sharing keys (again high security), others are 
>> dynamic keying (for which standards exist) and also involve manual
>>  configuration of files. So, I would suggest that existing means to
>>  configure the routing table with MNP and MR HoA is already secure
>>  enough not to make one care about the need of a new Prefix Table 
>> for implicit mode.)
> 
> :) there is some confusion again here. Prefix Table when used with 
> implicit mode is not used for authorization. only in explicit mode it
>  is used by the HA for the authorization check. infact the mobile 
> router is not claiming any prefix in the implicit mode. it is only a
>  mechanism by which the HA, in implicit mode, can use the entries in
>  the prefix table to create routes at the HA. it *is* an alternative
>  to creating static routes.

Oh yes, I remember. It is that file. Sorry. Maybe we could call it
Prefix File instead of Prefix Table. Prefix Table sounds too much like
routing table.  Or say somewhere that the Prefix Table is never
dynamically updated by nobody, only manually configured at boot time.

>> Another possible mechanism is where the Home Agent uses existing 
>> secure forwarding information [entries in the kernel routing table
>>  that are valid when the Mobile Router is at home] to find the 
>> association of the Mobile Network Prefix to the corresponding Home
>>  Address.
> 
> I am fine with adding this text. but note that this is possible even
>  with the existing text.

Ok, if in your reading that is possible, and supposedly in others'
reading too, then I don't propose adding that text; shorter texts are
better.

Alex
GBU

---

From: Alexandru Petrescu <[email-masked]>
Date: Thu, 24 Jul 2003 02:34:32 +0200

Alex
GBU

---

From: Kent Leung <[email-masked]>
Date: Thu, 24 Jul 2003 15:23:22 -0700

The Prefix Table seems to be overloaded functionally.

Let me see if I got this right?

In Implicit Mode, MNPs are preconfigured in Prefix Table for HA to inject 
routes
during BU.  Also Prefix Table is used to authorize IGP routing updates to 
prevent
incorrect routes from being propagated by HA.

In Explicit Network Mode, Prefix Table is used to authorized MNPs in options.

In Explicit Prefix Length Mode, Prefix Table is not used.

Wondering if we can try this?

Define the functional role of the table or database, such as MNP Injection DB
and MNP Authorization DB.  It may be implemented as one table or not should
not matter.

In Implicit Mode, HA will insert routes from the MNP Injection DB.  I don't 
think
the MNP Authorization DB is needed for IGP in the base protocol.  Folks can
implement this if desired.  But this is really beyond current router to router
behavior as been pointed out.

In Explicit Prefix Mode, the MNP Authorization DB is used to validate
MNPs in BU option.

This may help clarify some confusions in the discussions.  And hope it doesn't
add to it. :)

Kent

---

From: Kent Leung <[email-masked]>
Date: Thu, 24 Jul 2003 15:23:22 -0700

Kent

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 24 Jul 2003 16:07:44 -0700

> The Prefix Table seems to be overloaded functionally.

it is an optional data structure.

> during BU.  

yes.

> Also Prefix Table is used to authorize IGP routing updates to
> prevent

no.

> In Explicit Prefix Length Mode, Prefix Table is not used.

it is used in both, if needed. if the MR and HA have 
a subscription relationship, you dont normally expect
the MR to misbehave. but if in a certain deployment 
scenario, you expect misbehaving MRs, then you need 
this authorization check through the prefix table. if
you have some other way of doing this authorization
check, you dont need the prefix table.

> In Explicit Prefix Mode, the MNP Authorization DB is used to validate

sounds okay. but the MNP injection DB would be used
only in implicit mode. I dont think you need a new
DB for that. thats why the prefix table is used for
both. in explicit mode for MNP authorization and
in implicit mode for MNP injection. 
 
> This may help clarify some confusions in the discussions.  And hope it doesn't

there is a lot of confusion. we should probably add
more text while describing the prefix table.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 24 Jul 2003 16:07:44 -0700

yes.

no.

 

Vijay

---

From: Kent Leung <[email-masked]>
Date: Thu, 24 Jul 2003 18:38:45 -0700

> > incorrect routes from being propagated by HA.

That's good.  But I got this impression from your comments here.  I may 
have misread that
you said prefix table is used to explicitly check if MR claims a prefix via 
IGP in implicit mode.

>>  keys implicitly provide authentication and authorization. Prefix table 
>> goes a step ahead and enables the HA to explicity check if a mobile 
>> router owns a particular prefix it is claiming.
>

>check, you dont need the prefix table.

OK.  I'm not hung up on the "Prefix Table" name.  Trying to say that 
there's a function
needed to authorize MNPs that's different than injection function.

>more text while describing the prefix table.

It's clearer now that I know Authorization function is not applied in the 
Implicit Mode.

Kent

---

From: Kent Leung <[email-masked]>
Date: Thu, 24 Jul 2003 18:38:45 -0700

Kent