Re: [manet-dlep-rg] DLEP multicast address

["Stan Ratliff (sratliff)" <[e-mail]>]

On Nov 20, 2013, at 2:28 AM, Teco Boot <[e-mail]> wrote:

> 
> Op 20 nov. 2013, om 06:36 heeft Martin Duke <[e-mail]> het volgende geschreven:
> 
>> I actually think it makes implementation simpler. The server sends UDP packets occasionally to a well-known port and listens on a TCP port. The client just has to listen ona UDP port; no other cases to handle.

Maybe we are saying the same thing here? What I'm proposing is that the Peer Discovery is sent to a well-known port. But it is sent to an IANA-assigned link-local MCAST address. This peer discovery MAY continue to be sent on a periodic timer pop (with the heuristics of said timer at the discretion of the implementation), or it MAY cease once a TCP connection is established (reference the discussion about multiple DLEP peers existing on the same interface). Where I'm opposed is the notion of the Peer Discovery message being sent to a *unicast* address (what I thought was being described as some Out-of-band operation). I don't like that, it introduces additional protocol complexity, and we've already said that discovery is a 1-hop operation. If you *have* the unicast address to send the Peer Discovery to, then you've already got a-priori config. Either config it, or let it discover, but *NOT* both. Unless there's a *specific* use case you'd like to share - everything I've seen to this point is somewhat vague, and seems to relate to multi-hop operation, which we've also already said introduces a whole lot of assumptions and problems. 

>> With discovery messages always coming in, there's no need to build TCP retry heuristics.
> 
> This is the model I had in mind.
> No need to specify TCP retry mechanism or wait for a discovery packet, both are fine.
> 
> 
>> Configuration: I agree that there are no problems if client and server are identically configured. But part of an interoperability spec is not providing ways for client and server to get out of sync.
> This needs collision handling. When two TCP connections are set up, one has to be cleared. During the period that two connections are active, it is difficult to predict what will happen with order messages.

I read the point from Martin and the one from Teco as two different issues. As to the point from Martin - if the a-priori configuration is bad, then fix it. I don't know of a protocol that will somehow mitigate or re-sync bad configuration. That's a really bad idea, IMO. When you take "what the human said" (e.g. the configuration) and somehow munge it around, then the human that configured it in the first place is now ticked off that the code didn't pay attention to his config. I'm adamantly opposed to the notion of *specifying* how a discovery protocol overrides a-priori configuration. IMHO, that will be seen as a security vulnerability, instead of a "feature". 

Now, as to Teco's point. If there are collisions - that being, a TCP connect comes in on the same 4-tuple as an existing connection - the problem should be handled as the current DLEP does it. The older session is immediately terminated, and the new connection is used, starting from the Peer Initialize. This indicates that the two peers have lost state with each other; the only way to recover is to nuke the older, existing session, and pick up anew. 

> 
> 
>> Regardless, I suggest the Peer Discovery contain the TCP server port, and that if there is no Peer Discovery message the configuration must include the server port. That way, we need only get the UDP port number from IANA.
> 
> No, I want a passive model supported, where a TCP client can set up the connection on the IANA assigned well known DLEP port. Having the port allocated for UDP and TCP isn't a problem, I think. This enables multi-hop reachability to (or from) the modem. I don't know how to do that _from_ the modem.

No, Teco. Or actually, the answer is "You're *both* right". What's in my current -05 spec is that the TCP port TLV is OPTIONAL. If it's not there, then the connecter falls back to the well-known port number. If it *is* there, it's used. Offers good flexibility, without much complexity.

> 
> 
> May I repeat one of my use cases, where the DLEP (or derivate) protocol passes a crypto device with built in data diode. TCP will not make it here. See http://tools.ietf.org/html/draft-ivancic-manet-modemlpa Figure 5 for description of this use case (thanks to authors of modemlpa). I have to use some kind of DLEP proxy/tunnel, making the protocol uni-directional tunnel. For now, I see standardization of such mechanism as future work.

Yes, future work. Waaaaaay in the future. Don't want to get wrapped around the axle of what crypto devices are or are not doing. That will extend this process out ad-nauseum.

Stan


> 
> 
> Teco
> 
> 
>> 
>> On Nov 19, 2013 9:47 AM, "Stan Ratliff (sratliff)" <[e-mail]> wrote:
>> 
>> On Nov 19, 2013, at 1:28 AM, Martin Duke <[e-mail]> wrote:
>> 
>>> I don't think we want to rely just on TCP if we have OOB detection. Here are some cases where we need the peer discovery anyway:
>>> 
>>> 1. The router is configured with the modem address but the modem does not have the router address.
>> 
>> In the general case, the TCP client needs the address/port of the TCP server. 
>> 
>>> 
>>> 2. The modem has the router IP address but not the port. (I believe the latest concept requires zero standard TCP ports, and the Peer Discovery can simply include the port number.)
>> 
>> I don't think we should even try to cover all bases of mod-configuration. Your either provide a-priori config, or you don't. If you do, and it's wrong, then shame on you. ;-)
>> 
>>> 
>>> 3. The modem has the peer address, but powers up first; the TCP SYN gets no reply, backs off and times out.
>> 
>> "Heuristics for retrying the TCP session are left to the discretion of the implementation"… ;-) 
>> 
>>> 
>>> Clearly it is much cleaner for the router to send a UDP packet where we control the frequency and timeout.
>> 
>> This looks like a backup for bad a-priori config, or to address timing issues. IMO, it increases complexity of the implementation, and doesn't provide a whole lot of value-add. But I could be missing something. 
>> 
>> Regards,
>> Stan
>> 
>>> 
>>> On Thursday, November 14, 2013, Stan Ratliff (sratliff) wrote:
>>> If you've already got the the peer's address via some out-of-band mechanism, then why "discover" him? I've tried to separate things out so that the *only* thing discovery does is… wait for it… 'discover'. It tells you the address/port of where you need to go connect up. Pretty much all other init gets pushed back into the new Peer Initialization message. About the only thing that makes sense to me in discovery is the software level of the peers - If, for instance, I'm at DLEP Version 19, and I discover a potential DLEP peer at Version 1, I *might not* want to connect up in the first place.
>>> 
>>> Regards,
>>> Stan
>>> 
>>> 
>>> On Nov 14, 2013, at 10:56 AM, Rick Taylor <[e-mail]>
>>> wrote:
>>> 
>>>> +1 - Good point, I think we need to suggest some final text for this whole discovery process soon or we will forget our rough consensus.
>>>> 
>>>> Rick (on his other email address)
>>>> 
>>>> From: [e-mail] [[e-mail]] on behalf of Martin Duke [[e-mail]]
>>>> Sent: 14 November 2013 15:16
>>>> To: Taylor, Rick
>>>> Cc: [e-mail] Group ([e-mail]); Stan Ratliff (sratliff)
>>>> Subject: Re: [manet-dlep-rg] DLEP multicast address
>>>> 
>>>> I agree with almost all of what Stan and Rick said, but I don't think it would hurt to have a sentence like "A router MAY send unicast peer discovery messages to modems, regardless of logical distance, if it has obtained their IP address through an out-of-band process."
>>>> On Nov 14, 2013 2:13 AM, "Taylor, Rick" <[e-mail]> wrote:
>>>>> From: [e-mail] [mailto:manet-dlep-rg-
>>>>> [e-mail]] On Behalf Of Stan Ratliff (sratliff)
>>>>> Subject: Re: [manet-dlep-rg] DLEP multicast address
>>>>> 
>>>>> +1. Henning's right; there's no need to go to the IEEE, IMO...
>>>>> 
>>>>> Seems like the issue for us is how to scope discovery. Is it
>>>>> 
>>>>> (a) a single-hop operation, exploiting link-local MCAST, or
>>>>> (b) a potentially multi-hop operation, utilizing some sort of site-local
>>>>> or other MCAST technique/address?
>>>>> 
>>>>> I'm leaning to making it link-local (1-hop) myself. Note that does *NOT*
>>>>> preclude multi-hop DLEP operation over a TCP socket; it just means that
>>>>> multi-hop DLEP sessions would rely on a-priori configuration. There are
>>>>> *lots* of other issues that are going to confound, confuse, and otherwise
>>>>> screw-up multi-hop DLEP... ;-) Given the amount of characters typed over
>>>>> lesser issues, I don't know how far we want to go into multi-hop DLEP at
>>>>> this juncture. Suffice it to say my position is to write the spec in such
>>>>> a way as to avoid *precluding* it, but not to attempt to describe it.
>>>>> Multi-hop DLEP *can* work, given a careful network design (including a
>>>>> careful addressing policy). But I do not believe it will "generalize" down
>>>>> to something that warrants a section in the spec.
>>>> 
>>>> This is a big +1 from me.
>>>> 
>>>> Yes, we should specify that link-local multicast SHOULD be used (sent by the router periodically) and not forwarded.
>>>> 
>>>> Yes, we should add some text to say "Other discovery methods may be used, but then you start the standard TCP part of DLEP session establishment"
>>>> 
>>>> Yes, we should not preclude multi-hop links between router and modem, but also we should not get caught up in defining it - the draft IMHO should define the 1-hop behaviour only.
>>>> 
>>>> (When I say 'we' - I mean Stan and the other authors, it's just easier than translating all sentences into the passive voice and using 'one' instead, which just makes my prose increasingly Shakespearean which is unkind on those for whom English is a second language - this sentence being a case in point)
>>>> 
>>>> Rick
>>>> 
>>>>> 
>>>>> Stan
>>> 
>> 
>> _______________________________________________
>> manet-dlep-rg mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/manet-dlep-rg
>