Re: [dhcwg] Mirja Kühlewind's No Objection on draft-ietf-dhc-dhcpv6-failover-protocol-04: (with COMMENT)

[kkinnear <[e-mail]>]

Mirja,

Thanks for your review.

I'll respond to your questions directly, indented, below...

> On Feb 2, 2017, at 9:44 AM, Mirja Kuehlewind <[e-mail]> wrote:
> 
> Mirja Kühlewind has entered the following ballot position for
> draft-ietf-dhc-dhcpv6-failover-protocol-04: No Objection
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-dhc-dhcpv6-failover-protocol/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> A few questions that are not fully clear to me and maybe need some
> additional explanation in the draft (or maybe it's just me...):
> 
> - It's not fully clear to me when a TCP connection is opened or closed.
> Are the two servers supposed to have one long-lived connection? And if
> that connection is terminated for any reason, should the primary server
> try to re-open immediately? And if a (new) connection is (re-)open do I
> always need to send a CONNECT first, or only if I didn't have any
> connection with this server before? And if the secondary server goes down
> and comes up in RECOVER state (sec 8.5.1.), should it open a TCP
> connection to the primary server, or will always the primary server be
> the one that opens the connection (and if so when will it do it)?


	I would have thought that this was spelled out, but as I look
	at the draft I see that it isn't all that explicit.  While I
	could answer your questions directly, let me instead offer a
	new paragraph which tries to answer these questions for not
	just you but other readers of the document:


6.  Connection Management

   Communication between failover partners takes place over a
   long-lived TCP connection.  This connection is always initiated by
   the primary server, and if the long-lived connection is lost it is
   the responsibility of the primary server to attempt to reconnect to
   the secondary server.  The detailed process used by the primary
   server when initiating a connection and by the secondary server
   when responding to a connection attempt documented in
   Section 6.1 is followed each time a connection is established,
   regardless of any previous connection between the failover
   partners.

6.1.  Creating Connections


> 
> - Also not really clear to me is why OPTION_F_MAX_UNACKED_BNDUPD  is
> needed and how the server should know the right value. I guess you would
> want to calculate this based on the send buffer, however, not all message
> have the same size and as such I don't know how to calculate that. And is
> that really needed? If messages will not be accepted by the receiver-side
> server, the receive window will be zero and the socket on the sending
> side will be blocked; no additional message can be send. What will be
> different if the sender knows in advance when it could potentially happen
> (but also might not if the other end processes the messages quickly and
> there is no excessive loss).
> 


	The intent here is to keep the TCP connection unblocked, so
	that information can flow in both directions.  If one
	direction is is maxed out, it shouldn't keep information from
	flowing in the other direction.  At a TCP level it won't, but
	at an application level it will.  Much of the failover
	information flow involves one server sending a BNDUPD and then
	the partner sends a BNDREPLY.  If one server server sends more
	BNDUPD's than the other server can absorb, the TCP connection
	will block.  This will mean that any BNDREPLY's from the
	server that sent the BNDUPD's will also be blocked.  Ideally,
	the BNDUPD->BNDREPLY flow from each server to the other would
	be independent, and the OPTION_F_MAX_UNACKED_BNDUPD count is
	designed to help that be true.

	Additionally, there are messages other than BNDUPD/BNDREPLY
	(e.g. STATE, DISCONNECT, UPDDONE) that are important to
	transmit from one server to the other and not have backed up
	behind a blocked TCP connection that has been overloaded with
	BNDUPD's for the partner to process.

	We could have created a separate TCP connection for these
	control messages, but the overhead of doing that (and
	specifying that) was great enough that it seemed like using
	the application-level flow control of the
	OPTION_F_MAX_UNACKED_BNDUPD was a good tradeoff.


Thanks again for your review!

Kim