Subject: [nemo] FW: checking the Nemo tunnel

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Wed, 18 Feb 2004 17:37:14 -0000

Hi:

I believe that the text about nemo mrha tunnel handling could be
improved a bit: 

---------------------------------------------------------------------
 Let me suggest a little rephrasing for this paragraph:
 
 > >    The Home Agent has to verify that packets received through the
 > >    bi-directional tunnel belong to the mobile network.  This check
is
 > >    necessary in order to prevent nodes from using the Home Agent to
 > >    launch attacks that would have otherwise been prevented by
ingress
 > >    filtering.  The source address of the outer IPv6 header MUST be
set
 > >    to the Mobile Router's current Care-of address.  The source
address
 > >    of the inner IPv6 header MUST be a topologically correct address
with
 > >    respect to the IPv6 prefixes used in the mobile network.

 The Home Agent MUST validate the packets received through a
bi-directional tunnel.
 This check is necessary in order to prevent nodes from using the Home
Agent to
 launch attacks that would have otherwise been prevented by ingress
filtering.
 The source address of the outer IPv6 header MUST correspond to the
primary careof
 Address of an active registration. The source address of the inner IPv6
header MUST be a
 topologically correct address, meaning that it is reachable via the
home address for
 That active registration. The source address of the inner IPv6 header
may be either:
 a) the Home address for that registration (MN or MR)
 b) a global address from an MNP associated to that registration for a
registration with the
 'R' bit set
 c) ) more generally, if some additional routing takes place, an address
from a prefix that is
 routed via the registration home address, for a registration with the
'R' bit set.
 
 ------------------------------------------------------------

I believe we should open an issue for it. Note that MIPv6 is clear and
right about the fact that the inner packet has to be checked to make
sure that the tunnel is used by MN. Checking that the tunnel source
exists is not enough for basic Nemo. We have to do a reverse lookup. 

One important consequence of that is that the degraded mode (with non
Nemo enable HAs) does not work for basic Nemo Mobile Networks. Say you
have a static route to a MR MNP in a non Nemo MIPv6 HA. If you ping an
address on the MNP from the HA, the packet will be encapsulated and
responded to. But when the HA gets the tunneled response back, it checks
the inner packet source, and expects only a Home Address. Since the
source is not the MR Home Address but a MNP address, the HA drops the
packet. Too bad ain't it? 

The consequence of all this is that a MR registering to a non Nemo HA
can only register as a MIP MN, and can not expect to use the MRHA tunnel
to serve its MNPs...

What do you think?

Pascal

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 27 Feb 2004 17:06:32 -0800

Pascal,

the current text says

    The source address
    of the inner IPv6 header MUST be a topologically correct address with
    respect to the IPv6 prefixes used in the mobile network.

this text covers all three (a), (b) and (c) from the text you
are proposing below. it does not exclude any of them.

> exists is not enough for basic Nemo. 

thats not what the current text says. the source address should
should belong to a MNP that the mobile router is known to use.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 27 Feb 2004 17:06:32 -0800

Pascal,

the current text says

    The source address

Vijay