Subject: [nemo] Re: your comments on NEMO spec

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 04 May 2004 22:40:51 -0400

In message <[email-masked]>, Vijay Devarapalli writes:
>hi Steve,
>
>I am trying to address your comments on draft-ietf-nemo-basic-support
>
>> 3:      What good does it to to check the source address of the
>>         outer IPv6 header?  Spoofing that is far too easy.
>
>when the Mobile Router (MR) receives a tunneled packet
>from the Home Agent (HA), it looks like the following
>
>IPv6 hdr (src=HA, dst=MR_CoA)
>IPv6 hdr (src=CN, dst=MNN)
>Payload
>
>MNN (Mobile network node) is one of the nodes inside the
>Mobile Network.
>
>when the MR decapsulates the above packet and forwards the
>inner packet, it has to perform a few tunnel checks. it has
>to verify that the source address on the outer IPv6 header
>is the Home Agent and the destination address in the inner
>packet is one of the nodes in the Mobile Network. such
>checks need to be performed always, right?
>
>this check however only needs to be done if there is no
>IPsec protection (in tunnel mode) for the packets.

OK.  Should the above sentence be added as a clarification?
>
>> 
>> 6.1.2:  why is the prefix table check only a SHOULD and not a MUST?
>
>well, the mobile router and the HA most of the time share
>some kind of subscriber/provider relationship. the prefix
>table is needed only if you expect the mobile routers to
>misbehave. this was the concensus in the WG when this was
>discussed earlier.
>
>> 
>> 8:      This text is unclear:
>> 
>>            When the Mobile Router and the Home Agent exchange routes
>>            through a dynamic routing protocol, the Mobile Router
>>            should be careful in including the same Mobile Network
>>            Prefixes in the Binding Update to the Home Agent and in
>>            the routing protocol updates.  The Home Agent depending
>>            on its configuration might not add routes based on the
>>            prefix information in the Binding Updates at all, and
>>            might use only the routing protocol updates.  Moreover,
>>            including the same prefix information in both the Binding
>>            Update and the routing protocol update is redundant.
>> 
>>         Do you mean "be careful to include the same information in
>>         both places" -- redunancy is sometimes good.  Or do you
>>         mean "be careful to avoid doing this"?  Personally, I think
>>         the former is more appropriate, because it allows a check
>>         on the validity of the routing information.  Note that the
>>         prefixes announced via binding updates are checked for
>>         authorization; routing data generally is not.  I would thus
>>         suggest that routing advertisements MUST NOT contain any
>>         prefixes not known to the home agent by either implicit
>>         mode configuration or explicit mode announcement.

I don't see any response here.  Or is the response to 9 intended to 
cover this?  I think the language needs fixing no matter what.

>> 
>> 9:      When discussing Home Agent routing protocol processing, must
>>         the HA check the authorization for routing messages in general,
>>         or for the prefixes actually being announced?
>> 
>
>we actually wanted to avoid any kind of coupling between
>running an IGP and the NEMO basic support protocol.
>
>when a routing protocol is used between the mobile router
>and the HA, the bi-directional tunnel between the MR and
>the HA actually extends the IGP domain to include the MR.
>thats all. NEMO basic support protocol only creates the
>bi-directional tunnel (and few more things). we dont want
>NEMO to do the verification for routing protocol updates.
>
>if there is enough trust between the MR and the HA and
>they are configured to run an IGP, they do it. otherwise
>the MR and the HA should not run an IGP when the MR is
>not at home. we can make this more explicit if needed.
>
I'd appreciate that, especially since 8 does talk about some linkage.

		--Steve Bellovin, http://www.research.att.com/~smb

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 04 May 2004 22:40:51 -0400

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 21 May 2004 17:21:01 -0700

Hi Steve,

sorry for the delay in getting back to you.

> OK.  Should the above sentence be added as a clarification?

I added the following to section 3

    However, this check is not necessary
    if the packet is protected by IPsec in tunnel mode.

> cover this?  

yes. we would like to keep the routing protocol operation
and explicit mode separate.

> I think the language needs fixing no matter what.

I modified the text to say that when using a dynamic
routing protocol, the Mobile Router SHOULD NOT include
anything in the binding updates.

    When the Mobile Router and the Home Agent exchange routes through a
    dynamic routing protocol, the Mobile Router SHOULD NOT include the
    same Mobile Network Prefixes in the Binding Update to the Home Agent
    and in the routing protocol updates.

> I'd appreciate that, especially since 8 does talk about some linkage.

I added some text to the Security Considerations section.
this is the new text.

    The Home Agent MUST verify that the Mobile Router is
    authorized to send routing updates before processing the messages
    and propagating the routing information.  If there is not enough
    trust, that is required for two routers to exchange routing updates
    in a domain, the Home Agent MUST reject routing updates from the
    Mobile Router.  Since the routing protocol message could contain
    information about the internal routing structure of the home network,
    these messages require authentication and confidentiality protection.
    Confidentiality protection through IPsec ESP [4] SHOULD be used.

let me know if this addresses your concerns.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 21 May 2004 17:21:01 -0700

Hi Steve,

Vijay