Re: [Anima-bootstrap] Brian: Text to discover "Registrars" via GRASP

Brian E Carpenter <brian.e.carpenter@gmail.com> Fri, 23 September 2016 01:21 UTC

To: Michael Richardson <mcr+ietf@sandelman.ca>
References: <20160718170810.GX7377@cisco.com> <4b913a43-7248-deb2-3f26-834240ea7dff@gmail.com> <20160912213631.GD15177@faui40p.informatik.uni-erlangen.de> <e4028b68-9b02-8051-e502-1bd93f8aabd9@gmail.com> <20160913005250.GI15177@faui40p.informatik.uni-erlangen.de> <521f4ddc-e169-02c6-0180-dfea5d74c293@gmail.com> <28428.1474589565@obiwan.sandelman.ca>
From: Brian E Carpenter <brian.e.carpenter@gmail.com>
Organization: University of Auckland
Message-ID: <84aa9220-9e3a-4873-d4d0-54f85a267436@gmail.com>
Date: Fri, 23 Sep 2016 13:21:32 +1200
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0
MIME-Version: 1.0
In-Reply-To: <28428.1474589565@obiwan.sandelman.ca>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima-bootstrap/5Jy3sKUTZgmKvnwVDq5jt-HhztM>
Cc: anima-bootstrap@ietf.org
Subject: Re: [Anima-bootstrap] Brian: Text to discover "Registrars" via GRASP
Precedence: list

On 23/09/2016 12:12, Michael Richardson wrote:
> 
> {why isn't this on the list???}

Assuming you mean the bootstrap DT list, only because it started as a
very specific discussion point. So now it's on the list.

> 
> Brian E Carpenter <brian.e.carpenter@gmail.com> wrote:
>     > On 13/09/2016 12:52, Toerless Eckert wrote:
>     >> On Tue, Sep 13, 2016 at 11:12:20AM +1200, Brian E Carpenter wrote:
>>>>>> Currently we have:
>>>>>>       BRSKY via TLS/TCP
>>>>>>       BRSKY via CoAP/dTLS/UDP via IPIP
>     >>
>     >> I am actually confused right now why i added the "IPIP" into the mix...
>     >> *head* *scratching*
> 
>     > Yes, if you're inside the ACP it certainly seems redundant.
> 
> Either there are TCP/UDP circuit layer proxies (aka NAT66s or application
> layer alg-gateways), or there is an IPIP layer. In the later case, the
> packets look like:
> 
> pledge                     proxy                      registrar
> A ----- src:llA/dst:llP---->   ---src:acpP/dst:acpR------> R
>                                  IPIP:src:llA/dst:llP
> 
> We need the IPIP layer on the ACP side because the pledge/proxy
> communication is link-local only.

Sure. And I think we do need to settle the question of which method
is used. What is the advantage in the registrar seeing the link-local
addresses, which are never supposed to be visible off-link? Would
it help for diagnostics? If we want that, we want IPIP. If not, NAT66
would need to clamber over innumerable dead bodies). So then a transport
proxy seems best (to preserve end2end TLS).

> If the CoAP and TCP versions are different ASAs, then they can return
> different addresses and port numbers.
> If they are on the same ASA, I guess, yes, we need to return to answers.

Right. I assumed the second case for my demo code because it's more
demanding on GRASP.

   Brian

Re: [Anima-bootstrap] Brian: Text to discover "Re… Brian E Carpenter