Subject: [nemo] your comments on NEMO spec

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 05 Apr 2004 14:48:21 -0700

hi Steve,

I am trying to address your comments on draft-ietf-nemo-basic-support

> 3:      What good does it to to check the source address of the
>         outer IPv6 header?  Spoofing that is far too easy.

when the Mobile Router (MR) receives a tunneled packet
from the Home Agent (HA), it looks like the following

IPv6 hdr (src=HA, dst=MR_CoA)
IPv6 hdr (src=CN, dst=MNN)
Payload

MNN (Mobile network node) is one of the nodes inside the
Mobile Network.

when the MR decapsulates the above packet and forwards the
inner packet, it has to perform a few tunnel checks. it has
to verify that the source address on the outer IPv6 header
is the Home Agent and the destination address in the inner
packet is one of the nodes in the Mobile Network. such
checks need to be performed always, right?

this check however only needs to be done if there is no
IPsec protection (in tunnel mode) for the packets.

> 
> 5.4:    why is 140 not allowed in explicit mode? 6.6 implies that it should be.

you are right. I will fix this. the MR should process 140
always.

> 6:      no text in 6 about which modes Home Agents must support, similar to
>         the last paragraph of 5.2.

we do have something in section 6

    In order for a Mobile Router to operate correctly, the Home Agent
    MUST satisfy all the requirements listed in Section 8.4 of [1].  The
    Home Agent MUST implement both modes described in Section 5.2 of this
    document.

> 
> 6.1.2:  why is the prefix table check only a SHOULD and not a MUST?

well, the mobile router and the HA most of the time share
some kind of subscriber/provider relationship. the prefix
table is needed only if you expect the mobile routers to
misbehave. this was the concensus in the WG when this was
discussed earlier.

> 
> 8:      This text is unclear:
> 
>            When the Mobile Router and the Home Agent exchange routes
>            through a dynamic routing protocol, the Mobile Router
>            should be careful in including the same Mobile Network
>            Prefixes in the Binding Update to the Home Agent and in
>            the routing protocol updates.  The Home Agent depending
>            on its configuration might not add routes based on the
>            prefix information in the Binding Updates at all, and
>            might use only the routing protocol updates.  Moreover,
>            including the same prefix information in both the Binding
>            Update and the routing protocol update is redundant.
> 
>         Do you mean "be careful to include the same information in
>         both places" -- redunancy is sometimes good.  Or do you
>         mean "be careful to avoid doing this"?  Personally, I think
>         the former is more appropriate, because it allows a check
>         on the validity of the routing information.  Note that the
>         prefixes announced via binding updates are checked for
>         authorization; routing data generally is not.  I would thus
>         suggest that routing advertisements MUST NOT contain any
>         prefixes not known to the home agent by either implicit
>         mode configuration or explicit mode announcement.
> 
> 9:      When discussing Home Agent routing protocol processing, must
>         the HA check the authorization for routing messages in general,
>         or for the prefixes actually being announced?
> 

we actually wanted to avoid any kind of coupling between
running an IGP and the NEMO basic support protocol.

when a routing protocol is used between the mobile router
and the HA, the bi-directional tunnel between the MR and
the HA actually extends the IGP domain to include the MR.
thats all. NEMO basic support protocol only creates the
bi-directional tunnel (and few more things). we dont want
NEMO to do the verification for routing protocol updates.

if there is enough trust between the MR and the HA and
they are configured to run an IGP, they do it. otherwise
the MR and the HA should not run an IGP when the MR is
not at home. we can make this more explicit if needed.

I have filed your comments under issue # 34 at
http://people.nokia.net/vijayd/nemo/issues.html

Vijay