Re: Can lower layer tell there's connectivity? (Was: Re: New issue 16: No packets from other end?)

Hi Francis,

>    (1) Difference wrt IP layer connectivity and the ability to
>         talk between the IKEv2 peers.
>    
>         There is indeed a difference, the IKEv2 module could
>         suddenly die... or the client could have been disconnected
>         and the address recycled to someone else.
>    
>         Personally, I'm not sure this is worth covering. IP
>         connectivity should be enough. But see (2) below.
>    
> => we need both: IP connectivity and IKEv2 dead peer detection.
> None is really a part of MOBIKE.

I think I agree with this too, now...

>    (2) Ensuring that a given address really is the same
>         node. When probing for the correctness of a claimed
>         address, we may want to ensure that its indeed the
>         same IKEv2 node at this address.
>    
> => I agree: RR checks are the job of MOBIKE.

Ok.

>         It seems that the only way to do this is an IKEv2
>         message. But note that we are talking about address
>         update, not failure recovery here. So failure recovery
>         might still work using only IP layer connectivity
>         tests.
>    
> => IMHO recovery should have the priority over RR checks. Note this
> doesn't introduce a security issue because recovery is local and
> will happen without RR checks in a non-IPsec context.

The distinction between a probe to test whether an address
is usable for failover and whether its the same node in the
RR sense is a fine one. With proper protocol design, we
could actually achieve both in the same message. But I'm
also open to doing them separately. For instance, when I
tell you that I have address A, B, and C, you could verify
them at that time. Then when you get a problem with address
A, you could switch to B without any RR test. Nevertheless,
"switching to B" might imply a round of messages to B, so
this might not optimize very much.

>    (3) What current lower layers are able to tell to MOBIKE.
>         This is what I have been saying, that as far as I know,
>         current lower layer support in IPv6, DNA, DHC, etc.
>         only provides support for the discovery of available
>         addresses and locally operational addresses. Not the
>         discovery operational address pairs.
>    
> => this is clearly the main job of a multi-homing control and
> without it multi-homing is not really usable (*).
> 
>         I'm not saying that it wouldn't be possible to develop
>         one, just that one doesn't exist now. But I could be
>         missing something, I'm sure you guys will tell me what...
>    
> => the question is more who should develop one.

I agree.

--Jari