Subject: [Mip4] [issue45] RFC 3344 - FHAE issue when using a different care-of address

From: Sri Gundavelli <[email-masked]>
Date: Fri, 12 Mar 2004 23:43:30 +0000

This has been entered in the issue tracker as issue 45.

owner: Sri Gundavelli <[email-masked]>:

category: Technical
draft: draft-ietf-mip4-rfc3344bis
priority: Should fix
status: No discussion
title: RFC 3344 - FHAE issue when using a different care-of address

Issue: When the mobile node deregisters using the care-of address of 
a different foreign agent than the foreign agent forwarding the dereg 
request, the document is not consistent in its explanation as how the 
HA and FA should handle such requests.

Also, if the foreign agent is allowed to forward such requests, there
is no explanation as how the home agent should locate the security 
associations for that FA and validate the FHAE.

Section: 3.8.2.2. Accepting a Valid Request

In all cases, the home agent MUST send a Registration Reply to the
   source of the Registration Request, which might indeed be a different
   foreign agent than that whose care-of address is being
   (de)registered.  If the home agent shares a mobility security
   association with the foreign agent whose care-of address is being
   deregistered, and that foreign agent is different from the one which
   relayed the Registration Request, the home agent MAY additionally
   send a Registration Reply to the foreign agent whose care-of address
   is being deregistered. 

Section: 3.7.2.1. Validity Checks

   Requests with the 'D' bit set to 0, and specifying a care-of address 
   not offered by the foreign agent, MUST be rejected with code 77 
   (invalid care-of address).

Explanation:

When the MN sends a dereg request to a foreign agent with the intention 
of deregistering its earlier binding it had with a different foreign agent,
the behaviour of FA as documented in Section 3.7.2.1 is to reject such 
requst with invalid care-of address error. However, the HA considerations
(Section 3.8.2.2) allows such requests. The scenario is not handled 
consistently at both HA and FA ends. 

Also, if the foreign agent is allowed to forward such requests, there
should be some explanation as how the FA should function when it
receives a dereg message with "D" bit not set and care-of address
set to the MN's home address (Deregister all bindings) or when its
set to the care-of address of a different foreign agent. Assuming the
FA is allowed to forward such a request and when there is security
association configured between FA and the HA, the home agent will not
be able to validate the FHAE. The home agent for validating the FHAE
first needs to use COA address from the RRQ and use the SPI to locate
the security associations. Given that the care-of address is set to
either the home address of the mobile node or the care-of address of
a different foreign agent, how should the HA validate the FHAE ? The
HA cannot use the source address of the RRQ to locate the security
associations as there could be NAT in the path.
_________________________________________________
Mip4 issue tracker <[email-masked]>
<http://www.mip4.org/issues/tracker/mip4/issue45>
_________________________________________________

-- 
Mip4 mailing list: [email-masked]
    Web interface: https://www.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/