Foreign Agent Error Extension for Mobile IPv4
updates
- rfc-3344 — IP Mobility Support for IPv4
Extracted elements (13)
By placing foreign agent status in a separate extension rather than overwriting the Registration Reply's Code field, the mobile node can independently verify the Home Agent's reply integrity via the Mobile-Home Authentication Extension while still receiving the foreign agent's error information.
The FA Error Extension is defined as non-skippable because a mobile node that cannot interpret it must not use the care-of address, ensuring that error status from the foreign agent is never silently ignored in a way that could lead to an inconsistent or insecure network attachment.
This document updates RFC 3344: instead of the foreign agent modifying the 'status' field of the Registration Reply to contain value 68 (home agent failed authentication), the foreign agent should now append the FA Error Extension containing status value 68.
A mobile node that cannot correctly interpret the contents of the FA Error Extension MUST NOT use the care-of address provided in the Registration Reply message until another Registration Request has been sent and a successful Registration Reply received.
If a mobile node receives a successful Registration Reply (status code 0 or 1) with a FA Error Extension indicating the foreign agent is not honoring the reply, the mobile node SHOULD send a deregistration message to the home agent to prevent inconsistent registration state.
Status codes allowable for use within the FA Error Extension are within the range 64-127, drawn from the Mobile IPv4 foreign agent status codes defined in RFC 3344. Status codes used in the FA Error Extension must not be differently defined for use in the Code field of Registration Reply messages.
When a foreign agent appends a FA Error Extension to the Registration Reply, it MUST update the UDP Length field in the UDP header to account for the extra 4 bytes of extension length.
When denying a successful Registration Reply, the Foreign Agent SHOULD send a Registration Revocation message (RFC 3543) to the Home Agent if a mobility security association exists between them.
The FA Error Extension is a non-skippable Mobile IPv4 extension (Type 45) that allows a foreign agent to supply an error status code to the mobile node within a Registration Reply without modifying the Home Agent's data, preserving the Mobile-Home Authentication Extension integrity.
This specification reserves Type 45 from the non-skippable mobility extensions number space (0-127) for the FA Error Extension, and creates a new sub-type number space for this extension type with Sub-Type 0 allocated for the protocol defined here. Future sub-type allocations require expert review.
Because mobile nodes typically lack a security association with the foreign agent, a malicious foreign agent could send a FA Error Extension causing the mobile node to believe registration failed when both home agent and a legitimate foreign agent accepted it. The mobile node MAY delay processing denied Registration Reply messages briefly to check whether a successful reply arrives from the foreign agent.
The FA Error Extension improves Mobile IPv4 security by allowing the mobile node to verify Home Agent authenticity via the Mobile-Home Authentication Extension even when the foreign agent must supply error status. Previously, the foreign agent could only inject status by overwriting the reply code, destroying the mobile node's ability to verify the home agent's authentication data.
The FA Error Extension uses the Short Extension format: Type (1 byte, value 45), Length (1 byte, value 2), Sub-Type (1 byte, value 0), and Status (1 byte) carrying the foreign agent's status code. Total extension length is 4 bytes.