Subject: RE: [nemo] Editorial comments from Jari Arkko

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Wed, 3 Dec 2003 08:47:54 -0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Vijay Devarapalli
> Sent: mardi 2 décembre 2003 22:06
> To: Jari Arkko
> Cc: [email-masked]
> Subject: Re: [nemo] Editorial comments from Jari Arkko
> 
> Jari Arkko wrote:
> 
> >>>    A Mobile Network is a network segment or subnet which can move
> >>>    and attach to arbitrary points in the Internet.  A Mobile Network
> >>>    can only be accessed via specific gateways called Mobile Routers
> >>>    that manage its movement. Mobile Networks have (always exactly)|
> >>>    (at least) one Mobile Router serving them.
> >>
> >>
> >>
> >> fine with me.
> >
> >
> > Ok, but you still need to pick either "always exactly" or
> > "at least".
> 
> we cannot restrict to one mobile router. so its "at least".
> 
> >
> >>> Would it be useful to follow MIPv6 base Section 5.5 guidelines
> >>> on the use of source addresses?
> >>
> >>
> >>
> >> we already say in the spec (section 5.5), what the source and
> >> destination addresses should be for the inner and outer IPv6
> >> headers when sending packets through the bi-directional tunnel.
> >
> >
> > Yes, but you are not requiring that the source addresses be
> > checked. This opens a reflection attack via home agents that
> > don't get this.
> 
> there is some text in the Security Considerations section.
> 
>     The Home Agent has to verify that packets received through the
>     bi-directional tunnel belong to the Mobile Network.  This check is
>     necessary in order to prevent nodes from using the Home Agent to
>     launch attacks that would have otherwise been prevented by ingress
>     filtering.  The source address of the outer IPv6 header MUST be set
>     to the Mobile Router's current Care-of address.  The source address
>     of the inner IPv6 header MUST belong to the Mobile Network Prefix
>     owned by the Mobile Router.
> 

Note that in the reqs I proposed yesterday, I first thought I would copy that text and then I realized it was a bit restrictive and I replaced by topological correctness for the inner packet. What do you think? I believe this should be changed in the security section as well.

Pascal

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 03 Dec 2003 10:01:29 -0800

Pascal Thubert (pthubert) wrote:

> Note that in the reqs I proposed yesterday, I first thought I would copy 
> that text and then I realized it was a bit restrictive and I replaced by 
> topological correctness for the inner packet. What do you think? I believe 
> this should be changed in the security section as well.

hmm.. either way is fine with me. but dont you think "topological
correctness" is vague compared to what is there currently?

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 03 Dec 2003 10:01:29 -0800

Pascal Thubert (pthubert) wrote:

Vijay