140 likes | 213 Views
MIDCOM Protocol Semantics 55 th IETF. Martin Stiemerling, Juergen Quittek, Tom Taylor {stiemerling|quittek}@ccrle.nec.de taylor@nortelnetworks. Outline. Semantics overview Status Issues: Why PRR transaction? PRR behaviour Group transactions Address and port wildcarding
E N D
MIDCOM Protocol Semantics55th IETF Martin Stiemerling, Juergen Quittek, Tom Taylor {stiemerling|quittek}@ccrle.nec.de taylor@nortelnetworks
Outline • Semantics overview • Status • Issues: • Why PRR transaction? • PRR behaviour • Group transactions • Address and port wildcarding • Return values in PER • Split PER • Queing model for incoming messages • Capability exchange on Session Establishment • Other open issues
Semantics overview • Same transaction set for all middlebox types • Agent doesn‘t need to know middlebox type • Agent assumption: Twice NAT with packet filter (worst case) • First come first serve • Atomic transactions • Keep it simple, stupid
Status • Stable defintions: • Session control • Policy rule control • To be discussed/under construction • Group control • Prototype implementation done: • Implement complete semantics • Based on SIMCO protocol (draft-stiemerling-midcom-simco-02.txt) • Currently based on ASCII encoding • Upcoming version based on XML encoding
Why PRR? – The Problem • PER used for policy rule establishment • Need address/port mapping before complete 5-tuple is known to MIDCOM agent • No PER possible in this case • But may have only destination‘s parameters (IP address, port number, protocol type) • Example SIP signalling (see next slide)
SIP Telephone UA A SIP Softphone UA B SIP Proxy Middlebox INVITE UA A Listening on: IP_INT,P_INT Need external mapping for IP_INT,P_INT External mapping IP_MB,P_MAP INVITE UA A Listening on: IP_MB,P_MAP 200 OK...
PRR behaviour • Traditional NAT • Allocate only external mapped address/port • Twice NAT – two choices: • Allocated only external mapped address/port • Allocated external and internal mapped address/port • Any case known where both mapped adresses/ports are need during PRR times?
Group transactions • Currently: • Groups are created explictly • New proposal • Groups are created implicitly by PRR or PER • Impact on group transactions • GE and AGD can be dropped • GLC, GL and GS are kept • Default group can be dropped • No group lifetime • Group state machine can be dropped
Wildcarding • Several middlebox scenarios: • Packet filter • Traditional NAT • Twice NAT • NAPT • Different protocols • IP • TCP/UDP • Several combinations result in different wildcarding requirements
Return values in PER • What to return in PER inside and/or outside address/port not allocated • E.g. Packet filter middlebox • Traditional NAT (only outside address/port) • First choice: Return empty/NONE marker • Middlebox type no longer transparent to agent! • Second choice: Return external and/or internal endpoint addresses/ports
Split PER • Currently PER for state transistions: • RESERVED->ENABLED • PRID UNUSED->ENABLED • Split into two • PER1 (RES->ENA) • PER2 (UN->ENA) • PER1 and PER2 need different parameters
Message Queing • Is it required to add a first come first server message processing in section 2.1.2 „Atomicity“?
Capability Exchange on SE • Proposed capabilities: • Type of middlebox • Wildcard support • IP version • Supported optional transactions • Policy rule persistency • Maximum policy rule lifetime • Name of the default group • All needed? • Any other required?
Other open issues • Seperate IP protocol version and transport protocol type in PER/PRR? • Currently IP4/IP6/UDP4/UDP6/TCP4/TCP6 • Need to support ICMP, IGMP, RSVP, ... • Encryption method • In SE transaction • Should SE failure reply convey supported methods • Futher elaborated security considerations • Any other issues?