Subject: RE: [nemo] Editorial comments from Jari Arkko

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Thu, 4 Dec 2003 07:27:16 -0000

> -----Original Message-----
> From: Vijay Devarapalli [mailto:[email-masked]]
> Sent: mercredi 3 décembre 2003 19:01
> To: Pascal Thubert (pthubert)
> Cc: Jari Arkko; [email-masked]
> Subject: Re: [nemo] Editorial comments from Jari Arkko
> 
> Pascal Thubert (pthubert) wrote:
> >
> 
> >>
> >>    The Home Agent has to verify that packets received through the
> >>    bi-directional tunnel belong to the Mobile Network.  This check is
> >>    necessary in order to prevent nodes from using the Home Agent to
> >>    launch attacks that would have otherwise been prevented by ingress
> >>    filtering.  The source address of the outer IPv6 header MUST be set
> >>    to the Mobile Router's current Care-of address.  The source address
> >>    of the inner IPv6 header MUST belong to the Mobile Network Prefix
> >>    owned by the Mobile Router.
> >>
> >
> >
> > Note that in the reqs I proposed yesterday, I first thought I would copy
> > that text and then I realized it was a bit restrictive and I replaced by
> > topological correctness for the inner packet. What do you think? I believe
> > this should be changed in the security section as well.
> 
> hmm.. either way is fine with me. but dont you think "topological
> correctness" is vague compared to what is there currently?
> 
In the simple case it should end up being the same. 

But take the case where you run a tier routing protocol over the tunnel that has its own trust model. You can not refer to the prefixes obtained that way as MNPs.

The routing table can be seen as the repository for all prefixes that are authorized from a direction, whoever installs the routes.

Pascal

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 04 Dec 2003 10:27:13 -0800

> The routing table can be seen as the repository for all prefixes that are authorized from a direction, whoever installs the routes.

how about this?

    The Home Agent has to verify that packets received through the
    bi-directional tunnel belong to the Mobile Network.  This check is
    necessary in order to prevent nodes from using the Home Agent to
    launch attacks that would have otherwise been prevented by ingress
    filtering.  The source address of the outer IPv6 header MUST be set
    to the Mobile Router's current Care-of address.  The source address
    of the inner IPv6 header MUST be a topologically correct address with
    respect to the IPv6 prefixes used in the Mobile Network.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 04 Dec 2003 10:27:13 -0800

how about this?

Vijay