Subject: Re: [NSIS] NATFW: LE-MRM and NATFW_DTINFO_IPv4/IPv6

From: Martin Stiemerling <[email-masked]>
Date: Wed, 27 Sep 2006 17:30:56 +0200

Hi Roland and all,

Sorry for the delay in answering. I have been away on holidays and  
some business trips.

More inline.

   Martin
Am 09.08.2006 um 17:24 schrieb Roland Bless:

> Hi Martin,
>
> Martin Stiemerling wrote:
>> The LE-MRM has been just defined for the NAT usage and is not  
>> intended
>> for pure firewall usage. The main difference between LE-MRM and the
>> PC-MRM in the NAT case is: The message can probably not be forwarded
>> when the receiver is behind a NAT and it is using the PC-MRM with a
>> wildcarded sender IP address. When there are multiple NATs in  
>> parallel
>> to the Internet, GIST may have the issue of not knowing which  
>> route to
>> take. In this case GIST would return an error message. By using the
>
> Sorry, but I absolutely don't get it. Why doesn't the GIST node know
> which route to take? So a route lookup for the prefix N doesn't  
> succeed
> in this case (no route) or returns more than one entry (should not
> happen), or what? I can only imagine the "MRI too wild case",
> i.e., specifying a /7 when you only have /8s or so.

A node cannot know all possible inbound routes from the Internet. If
there is just a single inbound route, it is not an issue at all,
i.e., take this single route. However, if there are multiple inbound
routes, i.e., a firewall/NAT with multiple IP interfaces, it is
probably impossible to determine through which route the IP packets
will arrive at your box.

>
> So what I understand from the draft and you mail is that:
> - DS is currently unknown and somewhere outside your (DRs) NATed  
> domain.
> - DR wants to do a REA first which also includes a route pinning, i.e.
>   no matter which NAT your REA hits, the incoming stream from DS
>   will then hit that particular NAT.
> - DR sends a REA message "upstream" towards some external node
>   with IP address LS (and maybe LS!=DS) behind the NAT.
>   So the SDA is LS which is also used in the LE-MRM as destination.

Yes, that's right.

>
> Why, then can't we use the very same address in a PC-MRM, so
> ip.src=R, ip.dst=LS,
> pc-mrm.src= LS, pc-mrm.dst= R, pc-mrm.direction=upstream
> pc-mrm.prefixlength=32?
> So it's not a wildcarded PC-MRM. In this case I don't see
> any routing problem for GIST. Or, what is the reason that we must
> use a wildcarded PC-MRM?

What you describe was how we did it until the LE-MRM was
"invented". This was considered as a "dirty hack". There is no
public trace about this discussion, because it was on a sidetrack
offline. Do you know about this old draft, initially explaining
the reasoning for LE-MRM?

http://www.watersprings.org/pub/id/draft-stiemerling-nsis-natfw- 
mrm-02.txt

There is a semantical difference between the PC-MRM usage
you have described and the LE-MRM usage. The described
PC-MRM usage creates NTLP state at all NATFW NSLP nodes
with this MRI

pc-mrm.src= LS,
pc-mrm.dst= R,
pc-mrm.direction=upstream,
pc-mrm.prefixlength=32.

The PC-MRM creates the corresponding state for the flow described
with above MRI excerpt, i.e., flow source is LS, etc. This state
is never used again in the future and does not correspond to any
inbound flow, because LS is not the real flow source. So this is
to some degree ugly, because there is a state without relationship
to real life. This "signaling somewhere to get out here" (i.e.,
the LE-MRM) is actually not describing a flow, compared to the
PC-MRM. This is original reason to split them.
Another reason is the multiple inbound routes case. With LE-MRM
GIST is taking care about multiple inbound routes, because the
flow source is the signaling destination address (SDA) actually
not representing a flow. With PC-MRM the flow source may case
GIST to stop forwarding if there are multiple inbound routes.
Plus GIST cannot know whether the whole network is NAT'ed or not.

>
>> LE-MRM, GIST is always able to route the message upstream to "a"  
>> NAT. In
>> the first place it is not necessary to hit the best NAT, i.e.,  
>> closest
>> to the data sender but to get a public reachable IP address. By  
>> choosing
>> different SDAs, one may get a better or worse located NAT.
>
> I understand and this is also clear. If you vary LS, your NAT may
> differ, but this doesn't matter (except for suboptimal routing)
> because you pin down the route by hitting the NAT.
>
>> It is not that easy, because LE-MRM gives more power to hosts behind
>> NATs. LE-MRM will definitely find an edge-NAT while PC-MRM can easily
>> fail if there are multiple NATs in parallel.
>
> Sorry, but it's not clear to me why the LE-MRM gives more power
> to hosts. If we use a PC-MRM like in the scenario above, there
> will be no problem, or, can you explain once again, giving a concrete
> example, why it would fail?

Processing PC-MRM and LE-MRM is fundamentally different when it comes
to multiple inbound routes. PC-MRM will probably fail, because GIST
cannot determine which route is being taken. LE-MRM will keep working
in any case.

>
>> However, it is time to rework the section(s) on the LE-MRM/PC-MRM  
>> usage
>> (plus DTINFO) for getting it all clear. I see the issue of having the
>> information about the MRM usage spread too much over the document and
>> lack of some good introductory text.  There will be an updated  
>> text in
>> the next version clarifying this.
>
> Actually the "magic" or "special power" behind the LE-MRM is
> currently not getting clear. Maybe there are some implicit
> assumptions that are not written down yet.

I assume that the reasoning for all of it is not clear I you haven't
followed two years of discussions. Obviously, this is impossible.
I have it on my list for the upcoming revision, to clarify on the
LE-MRM usage and benefits.

Thanks!

   Martin

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis