Zero Address Set

Tschofenig Hannes <[email protected]>
Newsgroups gmane.ietf.mobike
Message-ID <[email protected]>
hi all, 

i thought about the functionality of the "zero address set". one important
question is: what is this functionality good for? 

draft <draft-kivinen-mobike-protocol-00.txt> says:
"
seconds how long the peer assumes to be disconnected
"

pasi calls this functionality (in draft <draft-eronen-mobike-mopo-01.txt>):

"
 temporarily forwarding the traffic of some SA to /dev/null
"

draft <draft-ietf-mobike-design-00.txt> is more verbose on this issue:

"
   One of the features which might be useful would be for the peer to
   announce the other end that it will now disconnect for some time,
   i.e. it will not be reachable at all. For instance, a laptop might go
   to suspend mode. In this case the peer could send address
   notification with zero new addresses, which means that it will not
   have any valid addresses anymore. The responder of that kind of
   notification would then acknowledge that, and could then temporarily
   disable all SAs. If any of the SAs gets any packets they are simply
   dropped. This could also include some kind of ACK spoofing to keep
   the TCP/IP sessions alive (or simply set the TCP/IP keepalives and
   timeouts large enough not to cause problems), or it could simply be
   left to the applications, i.e. allow TCP/IP sessions to notice the
   link is broken.

   The local policy could then decide how long the peer would allow
   other peers to be disconnected, i.e. whether this is only allowed for
   few minutes, or do they allow users to disconnect Friday evening and
   reconnect Monday morning (consuming resources during weekend too, but
   on the other hand not more than is normally used during week days,
   but we do not need lots of extra resources on the Monday morning to
   support all those people connecting back to network).
"

i see this issue from a different point of view.
we have a dead peer detection to provide a mechanism to delete the ike sa
(and ipsec sas) if the other does not respond anymore. 

if a laptop has establish an ike sa with a gateway, uses dead peer detection
and goes into the suspend mode then (even after a short amount of time) the
ike sa will be gone. 

the 'zero address set' functionality could possibly be seen as temporarily
suspending the dead peer protection on a specific address (or path). 

is this totally bogus? 

ciao
hannes
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.