Subject: [nemo] SPD entries for routing protocol messages

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 11 Dec 2003 18:34:05 -0800

hi Jari,

check out draft-ietf-ospf-ospfv3-auth-04.txt.

it is a WG document in the OSPF WG. it describes SPD entries
needed to protect OSPF messages. however the draft says
transport mode MUST be used because it assumes OSPF messages
are exchanged only between routers acting as hosts.

>    OSPFv3 packets are exchanged between the routers
>    but as the packets are destined to the routers, the routers act like
>    hosts in this case.  So transport mode SA MUST be used in order to
>    provide required security to OSPFv3.

in NEMO, the routing protocol messages are not forwarded. the
destination address on the routing protocol messages is either
the mobile router's address or the Home Agent's address inside
the tunnel interface between the Home Agent and Mobile Router.

if we assume the bi-directional tunnel to be a virtual link,
then RFC 2740 (OSPFv3) says

    On virtual links, global scope or site-local IP addresses must be
    used as the source for OSPF protocol packets.

so, an OSPFv3 packet from HA to MR could look like the following.

IPv6 hdr (src=HA, dst=MR_CoA)
IPv6 hdr (src=HA, dst=MR_HoA)
ESP hdr
OSPFv3 payload

maybe we have to just reference the above mentioned draft.

what do you think?

Vijay

---

From: Mattias Pettersson <[email-masked]>
Date: Mon, 15 Dec 2003 13:00:51 +0100

Hi Vijay,

>    used as the source for OSPF protocol packets.

Not that you are responsible for the wording of RFC 2740, but I'm 
curious why virtual links use the exception of global addresses. In 
IPv6, shouldn't all links be able to use link-local addresses? It is a 
more preferred approach, as you wouldn't have to assign a global prefix 
to that link, but instead just use link-local addresses. Point-to-point 
links between routers should not require global addresses.

Now in this case maybe you can use the packet design as you speficy 
below, but are the inner packet addresses really the best choices? The 
addresses HA and MR_HoA actually belong to another link (the physical 
home link in case we don't have a virtual home link).

Is this a problem?

/Mattias

---

From: Mattias Pettersson <[email-masked]>
Date: Mon, 15 Dec 2003 13:00:51 +0100

Hi Vijay,

Is this a problem?

/Mattias

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 15 Dec 2003 09:13:15 -0800

> home link in case we don't have a virtual home link).

I am fine with using link local addresses inside the tunnel.
dont know why RFC 2740 says "global scope or site-local IP
addresses must be used as the source for OSPF protocol
packets".

something that needs clarification in the OSPF WG.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 15 Dec 2003 09:13:15 -0800

Vijay

---

From: Yasuhiro Ohara <[email-masked]>
Date: Tue, 16 Dec 2003 22:22:14 +0900 (JST)

> something that needs clarification in the OSPF WG.

Hi,

Don't know about MIP (HA/CoA) thing but ...

Virtual link does not involve packet encapsulation.
It is just an adjacency forming (routing information exchange)
between routers of multi-hop far away.

You can't use linklocal address as neither source nor
destination address of the packet that traverse multi-hop.
If linklocal addresses are used in those field,
routers drops (rejects) the packet according to IPv6 spec,
... you know ;p)

regards,
yasu

---

From: Yasuhiro Ohara <[email-masked]>
Date: Tue, 16 Dec 2003 22:22:14 +0900 (JST)

Hi,

regards,
yasu

---

From: Mattias Pettersson <[email-masked]>
Date: Tue, 16 Dec 2003 14:52:54 +0100

> between routers of multi-hop far away.

OK, I see. Not quite what neither me nor Vijay envisioned.

> routers drops (rejects) the packet according to IPv6 spec,

Seems true...

 >>>>then RFC 2740 (OSPFv3) says

doesn't hold any longer, as OSPF doesn't deal with tunnels (not that I 
found anything about it while browsing through the spec).

I don't think that a virtual link can be used just like a tunnel would. 
Within a tunnel I thought we could run OSPFv3 with link-local addresses 
and make OSPFv3 unaware of that the tunnel moves when the MR moves.

But with virtual links the OSPFv3 implementation must now deal with that 
the MR end of the link changes its IP address. I'd prefer not to go this 
path; routing protocols should not have to be modified to run together 
with NEMO.

/Mattias

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 16 Dec 2003 08:40:09 -0800

> between routers of multi-hop far away.

my suggestion was to use the bi-directional tunnel
between the MR and the HA as a single hop virtual
link. and use transport mode protection for the
routing protocol messages exchanged on this link.

> routers drops (rejects) the packet according to IPv6 spec,

agree.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 16 Dec 2003 08:40:09 -0800

agree.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 16 Dec 2003 08:43:28 -0800

Mattias Pettersson wrote:
>>>> IPv6, shouldn't all links be able to use link-local addresses? It is 
>>>> a more preferred approach, as you wouldn't have to assign a global 
>>>> prefix to that link, but instead just use link-local addresses. 
>>>> Point-to-point links between routers should not require global 
>>>> addresses.
>>>>
>>>> below, but are the inner packet addresses really the best choices? 
>>>> The addresses HA and MR_HoA actually belong to another link (the 
>>>> physical home link in case we don't have a virtual home link).
>>>
>>>

okay. forget my earlier suggestion. lets go with link local
addresses inside with the tunnel.

agree.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 16 Dec 2003 08:43:28 -0800

agree.

Vijay