Subject: RE: [mobile-ip] WG Last Call on Threat Model and Security Require ments for MIP v6

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Thu, 18 Oct 2001 11:48:24 +1000

> Pekka Savola writes:
>  > But the _real problem_, one could say caused by MIPv6, is that all
> nodes
>  > (at least all mobile nodes) _must_ have this Routing Header processing
>  > enabled.  One could say MIPv6, as defined, may open every mobile node
> for
>  > abuse.
>  > 
>  > If there was no MIPv6, there would be no strong need to be able to
> process 
>  > routing headers in hosts, only a few, possibly hand-picked, routers.
> The 
>  > risks would be manageable.
> 
>    Couldn't there be different requirements for hosts
>    vs. routers? Ie, a node MUST process a packet with
>    a routing header, but MAY drop packets for which the
>    next destination address is not a valid destination
>    address for the host?
> 
>    Ie, the host will forward to its stack, but not
>    out another interface? This seems pretty consistant
>    with the definition of hosts and routers.
> 
	=> Exactly ! That's why I don't see the problem here. 
	In fact, this is what was done for the cellular host draft
	and it certainly does not break RFC 2460. It's an internal
	policy decision for those IPv6 nodes that do not want
	to act as reflectors. 

> 	   Mike
	Hesham

---

From: Michael Thomas <[email-masked]>
Date: Thu, 18 Oct 2001 08:16:55 -0700 (PDT)

> 	policy decision for those IPv6 nodes that do not want

   Not having looked recently, I'm not sure that
   I'd say that it's purely a policy knob on the
   host that is needed here. We should have clear
   requirements for both hosts and routers, and in
   this case the behavior of how hosts treat routing
   headers may be needed. It would be pretty unfortunate,
   for example, if hosts just didn't implement routing
   headers _at all_, which seems like a pretty likely
   outcome unless there's something that says you MUST
   if they will be forwarded to your stack...

	   Mike