Subject: [Softwires] Provisioning of "excluded ports" in draft-ietf-softwire-map-02

From: Tom Taylor <[email-masked]>
Date: Mon, 21 Jan 2013 10:42:45 -0500

Section 5.1.3 calls for the (optional) provisioning of a range of 
excluded ports as part of a mapping rule. As my notes in Decemeber 
hopefully made clear, the key issue is really whether system ports 
(0-1023) are to be excluded or not. How many actually get excluded is a 
function of block size, or of the sharing ratio if a = 0. The default 
value of 4096 currently given in Section 5.1.3 is the block size implied 
by an offset a = 4.

I would think an operator would not want to exclude any more ports than 
necessary. Hence what needs to be provisioned is simply a Boolean 
indication that system ports are to be excluded or not. If they are to 
be excluded, then:

- for a = 0, as many PSIDs as necessary beginning with PSID = 0 MUST NOT 
be used because the corresponding port ranges lie within the range 0-1023.

- for 1 <= a <= 6, the first block MUST NOT be used, because it contains 
the system port range. The corresponding number of excluded ports 
(including the system ports) ranges from 32768 for a = 1, down to 
exactly 1024 for a = 6.

- a > 6, more than one block has to be excluded to make up the complete 
range of 1024 ports.

The above bullets could be part of the explanation of the algorithm in 
Section 5.1. Section 5.1.3 should change only by replacing "excluded 
ports" by "whether system ports are excluded" and the default value of 
that to "yes".

Tom Taylor

---

From: Ole Troan <[email-masked]>
Date: Mon, 21 Jan 2013 16:55:18 +0100

Tom,

> Section 5.1.3 calls for the (optional) provisioning of a range of excluded ports as part of a mapping rule. As my notes in Decemeber hopefully made clear, the key issue is really whether system ports (0-1023) are to be excluded or not. How many actually get excluded is a function of block size, or of the sharing ratio if a = 0. The default value of 4096 currently given in Section 5.1.3 is the block size implied by an offset a = 4.
> 
> I would think an operator would not want to exclude any more ports than necessary. Hence what needs to be provisioned is simply a Boolean indication that system ports are to be excluded or not. If they are to be excluded, then:
> 
> - for a = 0, as many PSIDs as necessary beginning with PSID = 0 MUST NOT be used because the corresponding port ranges lie within the range 0-1023.
> 
> - for 1 <= a <= 6, the first block MUST NOT be used, because it contains the system port range. The corresponding number of excluded ports (including the system ports) ranges from 32768 for a = 1, down to exactly 1024 for a = 6.
> 
> - a > 6, more than one block has to be excluded to make up the complete range of 1024 ports.
> 
> The above bullets could be part of the explanation of the algorithm in Section 5.1. Section 5.1.3 should change only by replacing "excluded ports" by "whether system ports are excluded" and the default value of that to "yes".

wouldn't it then be simpler to require that a MUST be either 0 or 6? (or only 6).
the discussion we've had earlier was that the benefit of being able to easily recognise the PSID in a port, made up for the lost 3K ports.
which is what lead to an a=4.

cheers,
Ole

---

From: Tom Taylor <[email-masked]>
Date: Mon, 21 Jan 2013 14:42:53 -0500

Below.

On 21/01/2013 10:55 AM, Ole Troan wrote:
>> (0-1023) are to be excluded or not. How many actually get excluded
>> is a function of block size, or of the sharing ratio if a = 0. The
>> default value of 4096 currently given in Section 5.1.3 is the block
>> size implied by an offset a = 4.
>>
>> I would think an operator would not want to exclude any more ports
>> than necessary. Hence what needs to be provisioned is simply a
>> Boolean indication that system ports are to be excluded or not. If
>> they are to be excluded, then:
>>
>> - for a = 0, as many PSIDs as necessary beginning with PSID = 0
>> MUST NOT be used because the corresponding port ranges lie within
>> the range 0-1023.
>>
>> - for 1 <= a <= 6, the first block MUST NOT be used, because it
>> contains the system port range. The corresponding number of
>> excluded ports (including the system ports) ranges from 32768 for a
>> = 1, down to exactly 1024 for a = 6.
>>
>> The above bullets could be part of the explanation of the algorithm
>> in Section 5.1. Section 5.1.3 should change only by replacing
>> "excluded ports" by "whether system ports are excluded" and the
>> default value of that to "yes".
>
> wouldn't it then be simpler to require that a MUST be either 0 or 6?
> (or only 6). the discussion we've had earlier was that the benefit of
> being able to easily recognise the PSID in a port, made up for the
> lost 3K ports. which is what lead to an a=4.
>
> cheers, Ole
>

The trouble is, the value of a is related to the number of blocks by the 
formula

Number of blocks = 2^a

The number of blocks determines how many port ranges are allocated to 
each MAP CE (i.e. with system ports and hence the first block excluded, 
a = 4 implies that each sharing MAP CE is allocated 15 separate ranges 
of ports). I think you want to retain the operator's flexibility to 
allocate fewer blocks or, in the interest of reducing the chance that an 
attacker can guess the next port allocated, more blocks. Of course, the 
operators in the WG may disagree.

Tom

---

From: Ole Troan <[email-masked]>
Date: Thu, 24 Jan 2013 11:37:22 +0100

Tom,

[...]

> The trouble is, the value of a is related to the number of blocks by the formula
> 
> Number of blocks = 2^a
> 
> The number of blocks determines how many port ranges are allocated to each MAP CE (i.e. with system ports and hence the first block excluded, a = 4 implies that each sharing MAP CE is allocated 15 separate ranges of ports). I think you want to retain the operator's flexibility to allocate fewer blocks or, in the interest of reducing the chance that an attacker can guess the next port allocated, more blocks. Of course, the operators in the WG may disagree.

for the sake of simplicity I'd rather we made the offset fixed to 4, and that if one wants fine grained control of port ranges use something like PCP or DHCP.

that said, you are suggesting a rule, that would say something like: if a > 6, then the 6 most significant bits of A MUST not me zero.

e.g. with offset = 8, PSID length 4

xxxx xxXX PSID yyyy

then only the 'x' field > 0. thereby only excluding 1024 ports, with large offset.

cheers,
Ole