Subject: [pcp] State-diagram for NAT entries in PCP-controlled device

From: "Ranganathan T S (rangan)" <[email-masked]>
Date: Sun, 4 Dec 2011 05:52:09 +0530

Hi

This is with respect to the PCP draft ver 18 :
http://tools.ietf.org/html/draft-ietf-pcp-base-18

There is quite a bit of details provided in the draft considering 
various scenarios and error situations. But there are some scenarios,
like what would happen when PCP MAP request finds an existing entry
created by PCP PEER or vice versa, are not explicitly stated.

It is not very easy either to cover every details in words. 
Instead each NAT entry in a PCP-controlled device could be considered
as a state-machine. And a simple state-diagram that explain the 
transitions of the entries could help to address ambiguities. 

Following is one such diagram:

   Each mapping entry of the PCP-controlled device would go through the
   state machine shown below.

                     NO_TRAFFIC
                     and  P-LTE  +---------+  M-LTE
                   +------------>|         |<-----------+
                   |             |NO_ENTRY |            |
                   |   +---------|         |--------+   |
                   |   |         +---------+        |   |
                   |   |           ^     |          |   |
                   |   |   PROTOCOL|     |          |   |
                   |   |    TIMEOUT|     |          |   |
                   |   |           |     |          |   |
                   |   | P-R       |     |      M-R |   |
                   |   |           |     |          |   |
                   |   V           |     |          V   |
                +---------+        |     |      +---------+
     P-R or +-->|         |        |     | M-R  |         |<--+ M-R or
    TRAFFIC |   |    P    |--------|-----|----->|    M    |   | P-R or
            +---|         |        |     |      |         |---+ TRAFFIC
                +---------+        |     |      +---------+
                     |             |     |
                     |             |     |
                     |             |     | O-TRAFFIC
                     |             |     |
                     |   TRAFFIC   |     V
                     |  and P-LTE +-------+
                     + ---------->|       |
                                  |       |
                   +------------->|   I   |<------------+
                   |              |       |             |
             P-LTE |   +----------|       |---------+   | M-LTE
                   |   |          +-------+         |   |
                   |   |                            |   |
                   |   | P-R                    M-R |   |
                   |   |                            |   |
                   |   V                            V   |
                +---------+                      +---------+
    P-R  or +-->|         |                M-R   |         |<--+ M-R or
    TRAFFIC |   |   IP    |--------------------->|   IM    |   | P-R or
            +---|         |                      |         |---+ TRAFFIC
                +---------+                      +---------+

   The meanings of the states and events are:

   NO_ENTRY: Invalid state represents Entry does not exist.  This is the
      only possible start state.

   I: Mapping entry when created by TRAFFIC

   M: Mapping entry when created by MAP request

   P: Mapping entry when created by PEER request

   IM:  Mapping entry when created by TRAFFIC and is is also managed by
      MAP

   IP:  Mapping entry created by TRAFFIC and is also managed by PEER

   P-R:  PEER Request event

   M-R:  MAP Request event

   P-LTE:  PEER lifetime expired event

   M-LTE:  lifetime expired event

   TRAFFIC:  Traffic seen by PCP-controlled device using this entry
      within the expiry time for that entry.  This traffic may be
      inbound or outbound.

   NO_TRAFFIC:  Indicates that there is no TRAFFIC.

   O-TRAFFIC:  Oubound traffic that would create an entry in PCP-
      controlled device.

   The 'and' clause indicates the events on either side of 'and' are
   required for the state-transition.  The 'or' clause indicates either
   one of the events are enough for the state-transition.

Thanks and Regards,
Rangan.

---

From: "Ranganathan T S (rangan)" <[email-masked]>
Date: Mon, 5 Dec 2011 15:02:18 +0530

The differences between this and my previous post are:

* Added state transition between M to I 

* This simplified the state diagram. Two states, IM and IP, 

  are eliminated.

* Taken TCP-FIN and TCP-RST also into account

------------------------------------------------

                                 

                  TERM_MSGS or                      

         (NO_TRAFFIC and P-LTE)  +---------+  NO_TRAFFIC and M-LTE

                   +------------>|         |<------------+

                   |             |NO_ENTRY |             |

                   |   +---------|         |---------+   |

                   |   |         +---------+         |   |

                   |   |            ^  |             |   |

                   |   | NO_TRAFFIC |  |             |   |

                   |   |         or |  |             |   |

                   |   |  TERM_MSGS |  |             |   |

                   |   |            |  |             |   |

                   |   | P-R        |  |         M-R |   |

                   |   V            |  |             V   |

            +-->|         |         |  |    M-R  |         |<--+

        P-R |   |    P    |---------|--|-------->|    M    |   | M-R or

            +---|         |         |  |         |         |---+ P-R or 

                +---------+         |  |         +---------+   TERM_MSGS

                   |   ^            |  |             ^   |              

                   |   | P-R        |  |         M-R |   |

                   |   |            |  |             |   |

                   |   |            |  |             |   |

                   |   |            |  |             |   |

                   |   |            |  |             |   |

                   |   |            |  | O-TRAFFIC   |   |

                   |   |            |  V             |   |        

                   |   |         +---------+         |   |              

                   |   +---------|         |<--------+   |

                   |             |    I    |             |

                   +------------>|         |<------------+

              TRAFFIC and P-LTE  +---------+  TRAFFIC and M-LTE

 

   I: Mapping entry when created by O-TRAFFIC

   P-R:  PEER Request event

   M-R:  MAP Request event

      inbound or outbound.

   O-TRAFFIC:  Oubound traffic that would create an entry in 

      PCP-controlled device.

   TERM_MSGS: (Only for TCP entries) Protocol messages from the client 

      or server (e.g., due to TCP FIN or TCP RST), as per the NAT or 

      firewall device's existing policy.

Thanks and Regards,

Rangan.

_____________________________________________
From: Ranganathan T S (rangan) 
Sent: Sunday, December 04, 2011 5:52 AM
To: [email-masked]'
Subject: State-diagram for NAT entries in PCP-controlled device

Hi

 

                     NO_TRAFFIC

                   |             |NO_ENTRY |            |

                   |   |         +---------+        |   |

                   |   |           ^     |          |   |

                   |   |   PROTOCOL|     |          |   |

                   |   |    TIMEOUT|     |          |   |

                   |   |           |     |          |   |

                   |   | P-R       |     |      M-R |   |

                   |   |           |     |          |   |

                   |   V           |     |          V   |

                     |             |     |

                     |             |     |

                     |             |     | O-TRAFFIC

                     |             |     |

                     |   TRAFFIC   |     V

                     |  and P-LTE +-------+

                     + ---------->|       |

                                  |       |

                   |              |       |             |

                   |   |          +-------+         |   |

                   |   |                            |   |

                   |   | P-R                    M-R |   |

                   |   |                            |   |

                   |   V                            V   |

                +---------+                      +---------+

            +---|         |                      |         |---+ TRAFFIC

                +---------+                      +---------+

 

      MAP

   P-R:  PEER Request event

   M-R:  MAP Request event

      inbound or outbound.

      controlled device.

Thanks and Regards,

Rangan.