Subject: Re: [Mipshop] Adoption of draft-yokota-mipshop-pfmipv6 as a WG document

From: "Charles E. Perkins" <[email-masked]>
Date: Wed, 03 Sep 2008 12:46:27 -0700

Hello folks,

It seems like a good idea for this document to become
a working group draft.  However, I am not in favor
of the Mobility Header formulation for the signaling.
I think it would be better to maintain as close as
possible compatibility with the FMIP formats.

Regards,
Charlie P.

> Hello,
>
> At the MIPSHOP WG meeting at the last IETF, there was consensus to adopt
> draft-yokota-mipshop-pfmipv6 as a WG document. We would like to confirm
> that consensus on the mailing list. 
>
> Please respond by September 16, if you support or do not support
> adopting the document as a WG document. If you have already expressed
> your opinion in the WG meeting, there is no need to send an email on
> this.
>
> Vijay
> _______________________________________________
> Mipshop mailing list
> Mipshop at ietf.org
> https://www.ietf.org/mailman/listinfo/mipshop
>   
>
_______________________________________________
Mipshop mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mipshop

---

From: Hidetoshi Yokota <[email-masked]>
Date: Thu, 04 Sep 2008 23:19:30 +0900

Hi Charlie,

Thanks for your support and comment.
I see your point. It is a natural thought to follow the message format
defined in FMIPv6. The authors, however, received several requirements
from other sources and found that there are some rationales for using
the MH format.

* Since all the information handled by PFMIPv6 is related to the PMIPv6
operation and PMIPv6 uses the MH format, it is easier for the MAG to
handle only the MH than inspecting both headers.

* Many routers are configured to drop ICMPv6 packets for security
reason, so it would be easier to write a filter if PFMIPv6 uses the MH
format rather than inspecting the Type field of ICMPv6.

* Some people don't think using ICMP is the right way to convey
important messages that PFMIPv6 and PMIPv6 handle.

* Also, 3GPP2, which adopted this draft for their standards, prefers the
MH format. It's also good to listen to other SDOs and industry needs.

Note that none of the above completely precludes the use of ICMPv6. If
it is allowed to express my opinion, both are ok, although it would be
good to put priority on either one of those.

Regards,
-- 
Hidetoshi

---

From: "Vijay Devarapalli" <[email-masked]>
Date: Thu, 4 Sep 2008 13:10:40 -0400

Hello, 

> format rather than inspecting the Type field of ICMPv6.

We are not talking about a regular router here. It is a PMIPv6 MAG that
is processing these HI and HACK messages.

> important messages that PFMIPv6 and PMIPv6 handle.

Hmm.. We have used ICMPv6 messages quite a bit for mobility protocols in
the IETF. For example, DHAAD messages, Mobile Prefix
solicitations/Advertisements for MIPv6, HI and HACK in FMIPv6 [RFC
5268], Context Transfer protocol messages [RFC 4067], etc..

> good to put priority on either one of those.

We have to pick between the MH-based and ICMPv6-based HI and HACK
messages. Specifying both only causes confusion and IOT problems. 

Vijay

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Wed, 10 Sep 2008 14:21:32 -0500

Hi Hidetoshi,

> Subject: Re: [Mipshop] Adoption of 
> draft-yokota-mipshop-pfmipv6 as a WG document
> 
> Hi Charlie,
> 
> 
> * Many routers are configured to drop ICMPv6 packets for 
> security reason, so it would be easier to write a filter if 
> PFMIPv6 uses the MH format rather than inspecting the Type 
> field of ICMPv6.

[Ahmad]
Hmmm.. It is interesting. These messages are supposed to be secured,
e.g. IPsec. Right?
Why do we need to worry about an out-of-the-blue router that is
configured to drop secured ICMPv6 messages? 

> 
> * Some people don't think using ICMP is the right way to 
> convey important messages that PFMIPv6 and PMIPv6 handle.
>

[Ahmad]
I am not sure if we are in the business of specifying multiple solutions
and multiple ways to achieve the same thing. Some time back some people
were worried about the space of MH type; well, if ICMPv6 would suffice,
then truly, I believe these MH types is an absolute waste.
 
> * Also, 3GPP2, which adopted this draft for their standards, 
> prefers the MH format. It's also good to listen to other SDOs 
> and industry needs.

[Ahmad]
Oaky, Are we specifying an SDO specific standard document?

> 
> Note that none of the above completely precludes the use of 
> ICMPv6. If it is allowed to express my opinion, both are ok, 
> although it would be good to put priority on either one of those.
> 
> Regards,
> --
> Hidetoshi
> 
> > It seems like a good idea for this document to become a 
> working group 
> > draft.  However, I am not in favor of the Mobility Header 
> formulation 
> > for the signaling.
> > I think it would be better to maintain as close as possible 
> > compatibility with the FMIP formats.
> > 
> > Regards,
> > Charlie P.
> > 
> > 
> > 
> >> Hello,
> >>
> >> draft-yokota-mipshop-pfmipv6 as a WG document. We would like to 
> >> confirm that consensus on the mailing list.
> >>

---

From: Hidetoshi Yokota <[email-masked]>
Date: Thu, 11 Sep 2008 14:03:01 +0900

Hi Ahmad,

> configured to drop secured ICMPv6 messages? 

I basically cited a comment that I received. I guess it will be a little
bit easier to write the SPD on MAGs, which may be located in different
administrative domains.

Please allow me to cite your comment posted in March:

"3. These messages are ICMP messages and many operators do not like to
exchange sensitive information using ICMP messages, i.e. some operators
disable ICMP signaling all together."

You also think ICMPv6 is not good, or you changed your mind?

> then truly, I believe these MH types is an absolute waste.

Again, you don't like ICMPv6, right?

> Oaky, Are we specifying an SDO specific standard document?

No. We are now collecting whatever information available ranging from
individual comments to SDOs' requirements to select the best protocol.
3GPP2 is one of those (I should admit that it is an important one:-)).

Regards,
-- 
Hidetoshi

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Thu, 11 Sep 2008 00:41:05 -0500

Hi Hidetoshi,

> >> reason, so it would be easier to write a filter if
> field of 
> >> ICMPv6.
> I basically cited a comment that I received. I guess it will 
> be a little bit easier to write the SPD on MAGs, which may be 
> located in different administrative domains.
> 
> "3. These messages are ICMP messages and many operators do 
> not like to exchange sensitive information using ICMP 
> messages, i.e. some operators disable ICMP signaling all together."

[Ahmad]
Thanks!

> You also think ICMPv6 is not good, or you changed your mind?

[Ahmad]
No I did not change my mind. However, the security requirement of the
draft was not clear, at least to me.

But please take my comments with a grain of salt that the security
requirement at the time was not clear. At least now there is an
understanding that these messages will be secure. In that case, the
concern about ICMP messages being dropped is eliminated. 

Do not you agree?

BTW: changing minds is not a bad thing. Those who change their minds can
always claim that they have one:)

> > I am not sure if we are in the business of specifying multiple 
> > solutions and multiple ways to achieve the same thing. Some 
> time back 
> > some people were worried about the space of MH type; well, 
> if ICMPv6 
> > would suffice, then truly, I believe these MH types is an 
> absolute waste.
> 

[Ahmad]
If ICMPv6 messages are secure then I have no problem and I believe
standardizing additional MH messages is a waste. The idea hear, we can
not define two sets of messages doing the same thing.

> 
> >> * Also, 3GPP2, which adopted this draft for their 
> standards, prefers 
> >> the MH format. It's also good to listen to other SDOs and industry 
> >> needs.
> > 
> > [Ahmad]
> No. We are now collecting whatever information available 
> ranging from individual comments to SDOs' requirements to 
> select the best protocol.

[Ahmad]
No question about that:) 
However, in IETF, we need to make sure that the proposed solution
addresses the need of all other architectures and SDOs.

> 
> Regards,
> --
> Hidetoshi
> 
> >> Note that none of the above completely precludes the use 
> of ICMPv6. 
> >> If it is allowed to express my opinion, both are ok, although it 
> >> would be good to put priority on either one of those.
> >>
> >> Regards,
> >> --
> >> Hidetoshi
> >>
> >>>> At the MIPSHOP WG meeting at the last IETF, there was 
> consensus to 
> >>>> adopt

---

From: Hidetoshi Yokota <[email-masked]>
Date: Thu, 11 Sep 2008 17:19:32 +0900

Hi Ahmad,

> concern about ICMP messages being dropped is eliminated. 

There is no doubt that the HI/HAck messages must be secured whether they
are conveyed over ICMPv6 or MH. My take is that some MAG may be exposed
to the outer network and receive malicious attacks, so it needs to
inspect all received messages that may include unknown packets. ICMP has
been often used for attacking or probing target networks, so some
network administrators blindly cut off all ICMP packets. The security
issue here is not for HI/HAck, but for a more general IP operation. If
we can safely dismiss this issue or make it out of scope, then that's fine.

> always claim that they have one:)

Of course not. I'm forced to do it all the time with a series of
compromise:-). Anyway, when I talk to somebody, I just want to know
where he/she stands.

> not define two sets of messages doing the same thing.

There are other reasons to adopt MH-based ones, which are listed
together. Anyway, we need to further discuss if we should adopt both or
only one type.

> addresses the need of all other architectures and SDOs.

I don't think whether we choose ICMPv6 or MH will affect the
architecture:-) Anyway, it often happens that one SDO needs some
protocol immediately, while another SDO cannot even clarify their
requirements. IETF hence captures whatever requirements available at the
moment, foresees the future and tries to create the best possible
protocol. We are in the middle of this process, I guess.

Regards,
-- 
Hidetoshi

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Thu, 11 Sep 2008 05:36:00 -0500

Hi Hidetoshi,

> > 
> > Do not you agree?
> 
> There is no doubt that the HI/HAck messages must be secured 
> whether they are conveyed over ICMPv6 or MH. My take is that 
> some MAG may be exposed to the outer network and receive 
> malicious attacks, so it needs to inspect all received 
> messages that may include unknown packets. 

[Ahmad]
If we are talking about a secure domain with a trust model that covers
the nMAG, pMAG, and LMA, then I am not sure how that router comes in the
picture. May be a more detailed scenario would help us understand what
is missing. But anyhow, my point, as you to seem to agree, It does not
make any sense to specify two mechanism. We just need to specify one.

Regards,
Ahmad

---

From: "Vijay Devarapalli" <[email-masked]>
Date: Thu, 11 Sep 2008 11:41:57 -0400

Hello,

> not define two sets of messages doing the same thing.

RFC 4301 and 4306 allow you to protect ICMPv6 messages based on the
type. The ICMPv6 Type field is one of the selectors. There shouldn't be
an issue if you want to use IKEv2 to negotiate IPsec security
associations for protecting ICMPv6-based HI and HACK messages. 

Vijay

---

From: Basavaraj Patil <[email-masked]>
Date: Thu, 11 Sep 2008 10:50:17 -0500

I don't know why we are discussing using the ICMP messages for HI/HACK.
At least we (authors) concluded that we need to use MH type for the HI/HACK.
Is there an issue with that? Are MH types a scarce resource?

We are not proposing using either ICMP or MH type for HI/HACK. We are
proposing MH type in the context of this I-D.

-Raj

---

From: "Koodli, Rajeev" <[email-masked]>
Date: Thu, 11 Sep 2008 12:42:25 -0400

Right. As we know, RFC 5268 has HI and HAck in ICMP format and there is
obviously description of how to secure them.

This is not a beauty contest between ICMP and MH.

I think co-locating the processing of PFMIP and PMIP, which happens to
use MH, is beneficial. This is why I would go with it here. 

-Rajeev

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
Behalf
> Of Vijay Devarapalli
> Sent: Thursday, September 11, 2008 8:42 AM
> To: Ahmad Muhanna; Hidetoshi Yokota
> Cc: MIPv6 Signaling and Handoff Optimization Working Group Mailing
List
> Subject: Re: [Mipshop] Adoption of draft-yokota-mipshop-pfmipv6 as
> aWGdocument
> 
> Hello,
>

---

From: "Vijay Devarapalli" <[email-masked]>
Date: Thu, 11 Sep 2008 14:10:23 -0400

Hi Raj,

We don't yet have consensus on defining MH-based HI and HACK messages.
The use of ICMPv6-based HI and HACK messages for PFMIPv6 (and only
those) is still an option for draft-yokota-mipshop-pfmipv6.

Vijay

> From: Basavaraj Patil [mailto:[email-masked]] 
> Sent: Thursday, September 11, 2008 8:50 AM
> To: Vijay Devarapalli; Ahmad Muhanna; Hidetoshi Yokota
> Cc: MIPv6 Signaling and Handoff Optimization Working Group 
> Mailing List
> draft-yokota-mipshop-pfmipv6 as a WGdocument
> 
>