Re: [Roll] review of dao-projection -21

["Pascal Thubert (pthubert)" <[e-mail]>]

Hello Michael:

> 
> So I was trying to say that they should be accepted from the root only, and
> that we do this by IP address.   We are going to get some Sec-Review push
> back here, so let's get ahead of it.
> I know that we have effectively, no BCP38 filtering within the DODAG, so any
> node can impersonate the root, but at least we make it a bit harder, remove
> attacks from outside the LLN, and we guard against some minor bits of
> misconfiguration.
> 
> I think that all nodes know this because DODAGID, but I was always a bit
> fuzzy whether that value was arbitrary or not.
> 

OK, will not hurt to be very clear.
I'm adding text to "5.1.  New P-DAO Request Control Message" as follows:
"
   The Root MUST source the P-DAO message with its address that serves as
   DODAGID for the main DODAG. The recipient MUST NOT accept a P-DAO message that
   is not sent by the Root of its DODAG and MUST ignore such message silently.
"



>     >> Well, if we had the 6LR changes with state machine, then all the MUSTs
>     >> would migrate to that section.
> 
>     > Yes the state machine is always a debate. Some want it some not. Some
>     > want it in the main text some in appendix.
> 
>     > When in main  text it becomes normative and a bad companion for BCP14,
>     > because it's like saying things twice with a risk of discord.
> 
> I wouldn't be able to code this without documenting a state machine.
> I will then wind up asking questions from the state machine after the
> document is published.
> 

OK, I can think of how to make that clear. It's not that different of a normal DAO.

Keep safe;

Pascal