Subject: [core] Coap-07 deduplication rules - clarification needed?

From: "Dijk, Esko" <[email-masked]>
Date: Thu, 22 Sep 2011 09:23:35 +0200

Dear all,

I'd like to propose additional text for clarifying the duplicate detection rules in CoAP-07.
I noted that section 5.3 has detailed rules for request/response matching which include Message ID, IP address and UDP port matching.
For duplicate detection such rules are not specified so well.  The relevant text I found is:

A recipient MUST be prepared to receive the same confirmable message
(as indicated by the Message ID) multiple times
...
A recipient MUST be prepared to receive the same non-confirmable
message (as indicated by the Message ID) multiple times.

This leaves room for interpretation - an implementer may choose to

1.       Consider Message ID only in deciding whether a CoAP message is a duplicate or not;

2.       Consider Message ID and IP source address of the message;

3.       Consider Message ID, IP source address and UDP source port.

In my view for CoAP we should explicitly indicate whether option #2 or #3, or both, can be used.

best regards,
Esko

Esko Dijk

Philips Corporate Technologies, Research
High Tech Campus 34, Eindhoven, The Netherlands
[email-masked]<mailto:[email-masked]>

________________________________
The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.

---

From: Likepeng <[email-masked]>
Date: Thu, 22 Sep 2011 08:18:53 +0000

Hi Esko,

In my view, the duplication detection is the internal processing. So this should be left to the implementation to choose either 2, or 3, or both.

It is the implementation choice and there is no IOP issue. So, we don't need to specify it in the spec.

Kind Regards
Kepeng
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dijk, Esko
Sent: Thursday, September 22, 2011 3:24 PM
To: [email-masked]; Zach Shelby
Subject: [core] Coap-07 deduplication rules - clarification needed?

Dear all,

best regards,
Esko

Esko Dijk

---

From: "Dijk, Esko" <[email-masked]>
Date: Thu, 22 Sep 2011 10:36:01 +0200

Hi Kepeng,

I agree that this can be left as an implementation choice: that was what I meant with the "both" option. (Both are allowed).
Then the coap-07 text could be adapted only to rule out option #1, just in case. E.g.

A recipient MUST be prepared to receive the same confirmable message
(as indicated by the Message ID and source IP address) multiple times
...

because the information in the CoAP header alone does not suffice to tell whether a packet is a duplicate or not.

Esko

From: Likepeng [mailto:[email-masked]]
Sent: Thursday 22 September 2011 10:19
To: Dijk, Esko; [email-masked]; Zach Shelby
Subject: RE: Coap-07 deduplication rules - clarification needed?

Hi Esko,

Kind Regards
Kepeng

Dear all,

best regards,
Esko

Esko Dijk

---

From: "Angelo P. Castellani" <[email-masked]>
Date: Thu, 22 Sep 2011 10:39:07 +0200

Neither the IP address itself is sufficient when NAT/PAT is applied.

In my opinion the MID MUST be paired with the source IP address and
source UDP port informations.

Angelo

On Thu, Sep 22, 2011 at 10:36, Dijk, Esko <[email-masked]> wrote:
> Hi Kepeng,
>
>
>
> I agree that this can be left as an implementation choice: that was what I
> meant with the “both” option. (Both are allowed).
>
> In my view, the duplication detection is the internal processing. So this
> should be left to the implementation to choose either 2, or 3, or both.
>
>
>
> It is the implementation choice and there is no IOP issue. So, we don’t need
> to specify it in the spec.
>
>
>
> Kind Regards
>
> Kepeng
>
> I’d like to propose additional text for clarifying the duplicate detection
> rules in CoAP-07.
>
> I noted that section 5.3 has detailed rules for request/response matching
> which include Message ID, IP address and UDP port matching.
>
> This leaves room for interpretation – an implementer may choose to
>
> [email-masked]
> The information contained in this message may be confidential and legally
> protected under applicable law. The message is intended solely for the
> addressee(s). If you are not the intended recipient, you are hereby notified
> that any use, forwarding, dissemination, or reproduction of this message is
> strictly prohibited and may be unlawful. If you are not the intended
> recipient, please contact the sender by return e-mail and destroy all copies
> of the original message.
>
> _______________________________________________
> core mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/core
>
>

---

From: Klaus Hartke <[email-masked]>
Date: Thu, 22 Sep 2011 17:10:51 +0200

> For duplicate detection such rules are not specified so well.  The relevant

The text is written in the scope of one client communicating with one
server, i.e. duplicate detection must be performed within the scope of
the respective client.

> 3. Consider Message ID, IP source address and UDP source port.

With NoSec, a client is identified by IP source address and UDP source
port, so this (3.).

With other security modes, the client may be identified by
certificate, key, dtls session, ... in addition to or instead of IP
source address and UDP source port. But duplicate detection is not
necessary if the security mode prevents replay attacks.

Klaus