Zero Address Set
Tschofenig Hannes <[email protected]>
| Newsgroups | gmane.ietf.mobike |
|---|---|
| Message-ID | <[email protected]> |
hi all, i thought about the functionality of the "zero address set". one important question is: what is this functionality good for? draft <draft-kivinen-mobike-protocol-00.txt> says: " seconds how long the peer assumes to be disconnected " pasi calls this functionality (in draft <draft-eronen-mobike-mopo-01.txt>): " temporarily forwarding the traffic of some SA to /dev/null " draft <draft-ietf-mobike-design-00.txt> is more verbose on this issue: " One of the features which might be useful would be for the peer to announce the other end that it will now disconnect for some time, i.e. it will not be reachable at all. For instance, a laptop might go to suspend mode. In this case the peer could send address notification with zero new addresses, which means that it will not have any valid addresses anymore. The responder of that kind of notification would then acknowledge that, and could then temporarily disable all SAs. If any of the SAs gets any packets they are simply dropped. This could also include some kind of ACK spoofing to keep the TCP/IP sessions alive (or simply set the TCP/IP keepalives and timeouts large enough not to cause problems), or it could simply be left to the applications, i.e. allow TCP/IP sessions to notice the link is broken. The local policy could then decide how long the peer would allow other peers to be disconnected, i.e. whether this is only allowed for few minutes, or do they allow users to disconnect Friday evening and reconnect Monday morning (consuming resources during weekend too, but on the other hand not more than is normally used during week days, but we do not need lots of extra resources on the Monday morning to support all those people connecting back to network). " i see this issue from a different point of view. we have a dead peer detection to provide a mechanism to delete the ike sa (and ipsec sas) if the other does not respond anymore. if a laptop has establish an ike sa with a gateway, uses dead peer detection and goes into the suspend mode then (even after a short amount of time) the ike sa will be gone. the 'zero address set' functionality could possibly be seen as temporarily suspending the dead peer protection on a specific address (or path). is this totally bogus? ciao hannes