Re: Can lower layer tell there's connectivity? (Was: Re: New issue 16: No packets from other end?)

Hi Jari,

Jari Arkko wrote:
> Vijay Devarapalli wrote:
> 
>>> - In general, lower-layer mechanisms cannot tell whether pair
>>>   (Ai,Bj) provides connectivity between the IKEv2 endpoints:
>>>   only an IKEv2 message exchange can tell that.
>>
>>
>> totally disagree with this particular statement. assuming the IP
>> stack is the lower layer (with might include MIP6/MULTI6), why
>> would MOBIKE be able to figure out something the IP stack couldnt?
>>
>> UDP is a transport protocol on top of IP, right?
> 
> 
> There appears to be several questions here. What Pasi is stating
> need to made more specific before we can find agreement.
> I think we are talking about:
> 
> (1) Difference wrt IP layer connectivity and the ability to
>     talk between the IKEv2 peers.
> 
>     There is indeed a difference, the IKEv2 module could
>     suddenly die... or the client could have been disconnected
>     and the address recycled to someone else.
> 
>     Personally, I'm not sure this is worth covering. IP
>     connectivity should be enough. But see (2) below.
> 
> (2) Ensuring that a given address really is the same
>     node. When probing for the correctness of a claimed
>     address, we may want to ensure that its indeed the
>     same IKEv2 node at this address.
> 
>     It seems that the only way to do this is an IKEv2
>     message. But note that we are talking about address
>     update, not failure recovery here. So failure recovery
>     might still work using only IP layer connectivity
>     tests.
> 
> (3) What current lower layers are able to tell to MOBIKE.
>     This is what I have been saying, that as far as I know,
>     current lower layer support in IPv6, DNA, DHC, etc.
>     only provides support for the discovery of available
>     addresses and locally operational addresses. Not the
>     discovery operational address pairs.
> 
>     I'm not saying that it wouldn't be possible to develop
>     one, just that one doesn't exist now. But I could be
>     missing something, I'm sure you guys will tell me what...

It's possible that using DNA techniques, it may be possible to
tell when a path is not there for a subset of the cases
(based on local knowledge).

Mobile IPv6 is similar if there's knowledge that another trusted
address (for example a home address used in the IKE conversation)
is not available.  In this case, the knowledge about the
availability of the MIPv6 address is an extension of trust to
another location on the path. It looks like a local address to the
peer though, since it's used in end-to-end communication.

With non-local or non end-to-end information it's going to be difficult
to test unavailability unless there's preexisting or verifiable
trust from informants on the path. (for example if ICMPv6 destination
unreachable messages had authorization similar to that provided to
SEND (CGA) Routers).

If we can't trust indications from the network, we're stuck waiting
for IKE messages.

Greg