Subject: [BEHAVE] Simultaneous connect

From: Narasimhan Venkataramaiah <[email-masked]>
Date: Fri, 7 May 2010 18:48:27 +0000

I have a question about the TCP state machine in draft-ietf-behave-v6v4-xlate-stateful-11. In the description below - when a V4 SYN is received and there is no BIB for (X,x) a dummy session entry is created with (X',x) left unspecified. Is the sole purpose of this entry to delay the error propagation by TCP_INCOMING_SYN? As there is no BIB - there is no guarantee that when the V6 node sends the SYN to Y',y it will be mapped to (X,x). It is not looked up in the reverse direction - so if policy permits - an ICMP error will be sent for such a V4 SYN.

In summary - my understanding so far is that the paragraph below is saying - "If a v4 syn is received and there is no BIB for it - send an ICMP error if policy permits after 6 seconds". Is this correct?

Thanks.
Simha

If a V4 SYN packet is received with an incoming tuple with source
   IPv4 transport address (Y,y) and destination IPv4 transport address
   (X,x) (this is the case of a TCP connection initiated from the IPv4
   side), the processing is as follows:

      If the security policy requires silently dropping externally
      initiated TCP connections, then the packet is silently discarded,

Bagnulo, et al.          Expires October 1, 2010               [Page 27]
Internet-Draft               Stateful NAT64                   March 2010

      else,

      If the destination transport address contained in the incoming V4
      SYN (i.e., X,x) is not in use in the TCP BIB, then:

         The NAT64 tries to create a new session table entry in the TCP
         session table (if resources and policy permit), containing the
         following information:

         +  The STE source IPv4 transport address is set to (X,x) (i.e.
            the destination transport address contained in the V4 SYN)

         +  The STE destination IPv4 transport address is set to (Y,y)
            (i.e. the source transport address contained in the V4 SYN)

         +  The STE transport IPv6 source address is left unspecified
            and may be populated by other protocols out of the scope of
            this specification.

         +  The STE destination IPv6 transport address contains the port
            y (i.e. the same port than the destination IPv4 transport
            address) and the IPv6 representation of Y (i.e. the IPv4
            address of the destination IPv4 transport address),
            generated using the algorithm described in Section 3.5.4.

---

From: "Dan Wing" <[email-masked]>
Date: Mon, 10 May 2010 10:22:24 -0700

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Narasimhan 
> Venkataramaiah
> Sent: Friday, May 07, 2010 11:48 AM
> To: [email-masked]
> Subject: [BEHAVE] Simultaneous connect
> 
> I have a question about the TCP state machine in 
> draft-ietf-behave-v6v4-xlate-stateful-11. In the description 
> below - when a V4 SYN is received and there is no BIB for 
> (X,x) a dummy session entry is created with (X',x) left 
> unspecified. Is the sole purpose of this entry to delay the 
> error propagation by TCP_INCOMING_SYN? As there is no BIB - 
> there is no guarantee that when the V6 node sends the SYN to 
> Y',y it will be mapped to (X,x). It is not looked up in the 
> reverse direction - so if policy permits - an ICMP error will 
> be sent for such a V4 SYN. 
> 
>  
> 
> In summary - my understanding so far is that the paragraph 
> below is saying - "If a v4 syn is received and there is no 
> BIB for it - send an ICMP error if policy permits after 6 
> seconds". Is this correct?

Yes.  It is trying to specify the same behavior of 
REQ-4 of RFC5382.

-d