Re: Flow label versus Extension header - protocol itself

[marcelo bagnulo braun <marcelo@it.uc3m.es>]

...
> > fully agree, so this is not a problem, right?
> > i mean, before accepting packets from a given locator, this locator 
> > has to be be contained in the locator set and properly verified. 
> > through this verification process, it is possible to guarantee that 
> > the context tag associated to this locator is good for uniquely 
> > identify the associated shim context...
> > I mean, i don't see a problem which is specific to the context tag 
> > assignment mechanism....
>
> I agree.
>
> So sender or receiver allocation becomes purely a choice about
> whether to match on <source,tag> (receiver) or <source,dest,tag>
> (sender).

> Does the signalling have to say which destination locators a
> host will communicate to in the receiver case?

I guess that when a new ddestiantion locator is added in the context, 
if we are using sender based allocation, the sender may need to use a 
different tag for that destination, right?
in this case, when a dst locator is added, the sender may inform the 
receiver that a different tag will be used for that dst and the 
avaialbel source addresses.

> [chop]
> > > Well, perhaps it doesn't matter in the general "I haven't seen the
> > > address
> > > but I know the label", but for a previously known valid 
> > > <src,dest,label>
> > > mapping, you shouldn't need to signal that the packets are about to
> > > arrive like MIPv6 does now.
> > agree.
> > What is needed is a signalling mechanism to add locators to the 
> > locator set and properly verify it (at this point a valid context tag 
> > can be assoicated by the receiver, as you suggested)
> > Once that the locator is included in the locator set and verified, it 
> > can be used without prior signalling to announce its usage in the 
> > data packets
>
> Subsequent signaling (not on the critical path) may be able to be used
> to verify path reachability, in an analogous manner to STALE neighbour
> cache entries, if no upper layer confirmation is available.

right, but this is for fault tolerance rather than security right? so i 
guess that these checks will depend on local policy (i mean there may 
be a lot of potential src dst pairs to keep track of all of them)

regards, marcelo


> There should be some experiences available from IKE DPD which apply
> (if there is no use of IKE itself).
>
> Greg