Re: [manet-dlep-rg] DLEP session establishment

Op 12 nov. 2013, om 13:47 heeft Taylor, Rick <Rick.Taylor@cassidian.com> het volgende geschreven:

> Sorry for the delay, I was out of office yesterday.
> 
> My thoughts:
> 
>    Router                                        Modem
>    ===================================================
> 
> 1)                                  TCP socket listen()
> 
> 2)  <--------------------------- Peer Discovery Message
>                              UDP unicast or broadcast?
>                                       + Session Cookie

Cookies with expiration timers?
Doesn’t add much security. Maybe useful for sanity check. Let's use the MAC address as cookie.

I prefer real security, e.g. RFC 6622 or TLS. And access lists.

Let’s permit new usage scenario’s, where TCP connections are set up multiple hops away. E.g. from management station or PCE node.

>                                     + TCP address/port
>           + Alternate reliable protocol endpoint infos
> 
> 3)  TCP connect()
> 
> 4)  Initialize (was Peer Offer) ---------------------->
>    + Session Cookie
> 
> 5)  <----------------------------------- Initialize ACK
>                                       + Session Cookie
>                                + Supported metric TLVs
> 
> 
> My reasoning, often agreeing with others:
> 
> The Modem 'advertises' its DLEP support, and therefore should
> be the one that listens for the TCP connect.
> 
> A cookie passed between the UDP discovery message and the TCP
> connection adds a little security (is this the modem I think I am
> connecting to?)  This could be extended to a full signature TLV
> in a later RFC.

Let’s do this right now. We can reuse existing security mechanisms, with some details how to implement.

> 
> The Peer Discovery message could carry additional reliable
> protocol endpoint information for non-TCP transports.
> 
> The Initialize ACK is the correct place to put the 'default'
> metric TLVs, and is sent by the modem.
> 
> A 3-way handshake seems safer to me.
> 
> I have a question over whether the Peer Discovery message should
> be unicast to a configured destination, or broadcast to all
> connected peers on a TBD port.  I prefer broadcast as it is more
> ZeroConf, but I can see use-cases for unicast to a configured
> destination for more complex topologies.

Router can set up the TCP connection, if it knows the Modem IP address. Let’s keep the modem a somewhat dummy device.

Teco

> 
> Cheers,
> 
> Rick Taylor
> 
>> -----Original Message-----
>> From: manet-dlep-rg-bounces@ietf.org [mailto:manet-dlep-rg-
>> bounces@ietf.org] On Behalf Of Teco Boot
>> Sent: 11 November 2013 16:29
>> To: Stan Ratliff
>> Cc: DLEP Research Group (manet-dlep-rg@ietf.org)
>> Subject: [manet-dlep-rg] DLEP session establishment
>> 
>> 
>> Op 11 nov. 2013, om 01:55 heeft Stan Ratliff (sratliff)
>> <sratliff@cisco.com> het volgende geschreven:
>> 
>>> Also, as to the Discovery: Here's what I'm writing up as we speak:
>>> 
>>> 
>>> Router
>> Modem
>>> ========================================
>>>                                    <------------------------ Peer
>> Discovery Message
>>> Peer Offer with           ------------------------->
>>> unicast IP addr/
>>> port for TCP connect
>> 
>> So this is multicast reply, telling modem to connect?
>> Why not TCP connect from router to modem? Makes more sense to me, the
>> modem is the peer offering a service.
>> Maybe add a TcpPort TLV in the Peer Discovery, this allows other than IANA
>> assigned ports.
>> 
>> 
>>> 
>>> *Connect on TCP socket. Router has issued TCP "listen",
>>>   modem issues TCP "connect" (e.g. Modem is the TCP "client",
>>>   router is the TCP "server")
>>> 
>>> Now, The modem's UDP socket can be closed.
>> 
>> Please don't.
>> 
>> 
>>> Over the TCP
>>> Socket,
>>>                                   <------------------------- Peer
>> Initialization containing
>>> 
>> TLVs/default values for ALL
>>> 
>> supported metric values - all
>>> 
>> meaning the MANDATORY ones,
>>> 
>> plus any optional metrics (right now,
>>> 
>> just Resources) that are supported.
>> 
>> Yes, here the full set TLV exchange takes place. This should not be in the
>> Peer Discovery. That's why I suggested to put this in the Peer Offer.
>> 
>> 
>>> 
>>> Peer Initialization ACK ---------------------->
>>> MAY contain optional
>>> Layer 3 (address) TLVs
>> 
>> I'm fine with three way handshake, not with this two way. Or use TCP
>> disconnect when modem modem is not willing to accept first message from
>> router.
>> 
>> Teco
>> 
>>> 
>>> .... And, everything from there is basically the same as before.
>> 
>> _______________________________________________
>> manet-dlep-rg mailing list
>> manet-dlep-rg@ietf.org
>> https://www.ietf.org/mailman/listinfo/manet-dlep-rg
> The information contained within this e-mail and any files attached to this e-mail is private and in addition may include commercially sensitive information. The contents of this e-mail are for the intended recipient only and therefore if you wish to disclose the information contained within this e-mail or attached files, please contact the sender prior to any such disclosure. If you are not the intended recipient, any disclosure, copying or distribution is prohibited. Please also contact the sender and inform them of the error and delete the e-mail, including any attached files from your system. Cassidian Limited, Registered Office : Quadrant House, Celtic Springs, Coedkernew, Newport, NP10 8FZ Company No: 04191036 http://www.cassidian.com