Subject: [manet] Proposed text for Errata 6472 (and friends)

From: Rick Taylor <[email-masked]>
Date: Fri, 12 Nov 2021 16:35:52 +0000

Hi All,

Here is my proposed text for the raised Errata.  Please review and comment, as there are particular combinations of if/MUST/else that can be confusing.

------
Section 12.4, para 2.  Replace with:

A Peer Offer Signal MUST be encoded within a UDP packet. The destination IP address and UDP port of the packet MUST be the source IP address and UDP port of the received Peer Discovery Signal packet.  If the modem includes IPv4 or IPv6 Connection Point Data Items in the Peer Offer Signal then the source IP address and UDP port of the packet may be any valid local UDP address/port combination.  If the Peer Offer Signal does not include IPv4 or IPv6 Connection Point Data Items, then the source IP address and UDP port of the packet MUST be set to the unicast IP address and TCP port the router MUST use when connecting the DLEP TCP session, as defined in Section 7.1.  The Peer Offer Signal completes the discovery process.
-----

Cheers,

Rick

---

From: "Sipos, Brian J." <[email-masked]>
Date: Tue, 16 Nov 2021 22:25:50 +0000

Rick,
For the first condition (connection point is present) there is still a lack of
preference for UDP port number, which leaves things open. Can the source UDP
port in that case be required (even a SHOULD would help) to be the same port
number listened-for by the modem (i.e. the destination the port number of the
Peer Discovery Signal)?

In a typical case, I expect the modem would be listening on standard UDP port
854 so the Peer Offer would have a source port of 854. This makes things
easier on traffic monitors so that it's not a UDP datagram from
ephemeral-to-ephemeral port. It could also simplify implementation because the
listening bound socket would also be usable for sending the response.

Thanks,
Brian S.

-----Original Message-----
From: manet <[email-masked]> On Behalf Of Rick Taylor
Sent: Friday, November 12, 2021 11:36 AM
To: [email-masked]
Subject: [EXT] [manet] Proposed text for Errata 6472 (and friends)

APL external email warning: Verify sender [email-masked] before
clicking links or attachments

Hi All,

Here is my proposed text for the raised Errata.  Please review and comment, as
there are particular combinations of if/MUST/else that can be confusing.

------

A Peer Offer Signal MUST be encoded within a UDP packet. The destination IP
address and UDP port of the packet MUST be the source IP address and UDP port
of the received Peer Discovery Signal packet.  If the modem includes IPv4 or
IPv6 Connection Point Data Items in the Peer Offer Signal then the source IP
address and UDP port of the packet may be any valid local UDP address/port
combination.  If the Peer Offer Signal does not include IPv4 or IPv6
Connection Point Data Items, then the source IP address and UDP port of the
packet MUST be set to the unicast IP address and TCP port the router MUST use
when connecting the DLEP TCP session, as defined in Section 7.1.  The Peer
Offer Signal completes the discovery process.
-----

Cheers,

Rick

_______________________________________________
manet mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/manet

---

From: Henning Rogge <[email-masked]>
Date: Fri, 19 Nov 2021 09:44:28 +0100

You cannot do the receiver for the UDP discovery packets on an
ephemeral port anyways... wouldn't it be the usual thing just use the
same socket for sending the unicast reply?

Henning Rogge

---

From: Rick Taylor <[email-masked]>
Date: Fri, 19 Nov 2021 09:39:15 +0000

Hi Both,

IPv4/6 Connection Point data items contain a port number, so there is no confusion about which port to use to establish the TCP session when the Data Item is included in the response.  The Source IP/port in the response is irrelevant - it just needs to be 'valid' (i.e. not multicast, etc).  The source port can be ephemeral, as nothing is listening for anything further on that port.

When Connection Point data items are missing, set the Source IP/Port of the Peer Offer response packet to the TCP IP/port combo that is listening for the TCP session connect().  In most cases, that will be the same IP address and port (854) as the Discovery UDP is using, so there is little to do programmatically, it's only difficult when the ports are different. 

In either case, always set the destination IP/port to the Source combo of the original Discovery signal.

When writing this using the BSD sockets API, a lot of this ephemeral port detail is skipped thanks to the API.  As a modem:

1. Create a S1 = socket(UDP)
2. bind(S1) to DLEP interface, port 854.
3. Join the multicast group
4. recvfrom(S1, Peer Discovery)
5a. If we use Connection Point Data Items, or use the same address and port 854 for the TCP session:   sendto(S1, Peer offer) to source sockaddr of the received packet.
5b. Else: create a new S2 = socket(UDP) and bind(S2) to DLEP interface, UDP port = custom TCP port, then sendto(S2, Peer offer) to source sockaddr of the received packet.

Does that help?

Cheers,

Rick

> From: Henning Rogge [mailto:[email-masked]]
> Sent: 19 November 2021 08:44
> To: Sipos, Brian J.
> Cc: Rick Taylor; [email-masked]
> Subject: Re: [manet] Proposed text for Errata 6472 (and friends)
>

---

From: Henning Rogge <[email-masked]>
Date: Fri, 19 Nov 2021 10:47:42 +0100

Hi,

I think at least some of the issues arise because modern IP radios
often have weird, small or sometimes incomplete IP stack
implementations... so you sometimes have to choose your source and
destination MAC for your outgoing packets.

I remember at least one radio whose IP stack crashed as soon as it
tried to parse a fragmented IP packet... and its HTTP server could not
handle requests distributed over more than one IP packet either.

Henning

---

From: "Sipos, Brian J." <[email-masked]>
Date: Fri, 19 Nov 2021 20:20:43 +0000

Rick,
All of these details make sense and I don't disagree with any of the discussion. I believe it would just be helpful for the spec to fully define the Peer Offer source UDP port so that, for example, a Router can configure a firewall and know that things are going to work. If I know that a modem (of some type) is "operating on" UDP and TCP port X, then I can configure my router firewall to allow inbound UDP source port X and not run into a situation where the modem sends UDP from some other port that my firewall will drop.

I agree that the UDP source port could be anything and the router application doesn't care; and I expect that current implementations are already responding with a well-defined source port as your notional example shows. It’s the middle-boxes between modem and router application that could be an issue if the port is left unconstrained (when a Connection Point is present within). This is especially true because the Peer Discovery uses a multicast address, so there is no "UDP conversation" to follow from a middle-box's perspective.

-----Original Message-----
From: Rick Taylor <[email-masked]>
Sent: Friday, November 19, 2021 4:39 AM
To: Henning Rogge <[email-masked]>; Sipos, Brian J. <[email-masked]>
Cc: [email-masked]
Subject: [EXT] RE: [manet] Proposed text for Errata 6472 (and friends)

APL external email warning: Verify sender [email-masked] 
before clicking links or attachments

Hi Both,

IPv4/6 Connection Point data items contain a port number, so there is no 
confusion about which port to use to establish the TCP session when the Data 
Item is included in the response.  The Source IP/port in the response is 
irrelevant - it just needs to be 'valid' (i.e. not multicast, etc).  The 
source port can be ephemeral, as nothing is listening for anything further on 
that port.

When Connection Point data items are missing, set the Source IP/Port of the 
Peer Offer response packet to the TCP IP/port combo that is listening for the 
TCP session connect().  In most cases, that will be the same IP address and 
port (854) as the Discovery UDP is using, so there is little to do 
programmatically, it's only difficult when the ports are different.

In either case, always set the destination IP/port to the Source combo of the 
original Discovery signal.

When writing this using the BSD sockets API, a lot of this ephemeral port 
detail is skipped thanks to the API.  As a modem:

1. Create a S1 = socket(UDP)
2. bind(S1) to DLEP interface, port 854.
3. Join the multicast group
4. recvfrom(S1, Peer Discovery)
5a. If we use Connection Point Data Items, or use the same address and port 
854 for the TCP session:   sendto(S1, Peer offer) to source sockaddr of the 
received packet.
5b. Else: create a new S2 = socket(UDP) and bind(S2) to DLEP interface, UDP 
port = custom TCP port, then sendto(S2, Peer offer) to source sockaddr of the 
received packet.

Does that help?

Cheers,

Rick

> On Tue, Nov 16, 2021 at 11:26 PM Sipos, Brian J.
> <[email-masked]>
> wrote:
> >
> > Rick,
> > For the first condition (connection point is present) there is still
> > a lack of preference for UDP port number, which leaves things open.
> > Can the source
> UDP
> > port in that case be required (even a SHOULD would help) to be the
> > same
> port
> > number listened-for by the modem (i.e. the destination the port
> > number of
> the
> > Peer Discovery Signal)?
> >
> > In a typical case, I expect the modem would be listening on standard
> > UDP
> port
> > 854 so the Peer Offer would have a source port of 854. This makes
> > things easier on traffic monitors so that it's not a UDP datagram
> > from ephemeral-to-ephemeral port. It could also simplify
> > implementation
> because the
> > APL external email warning: Verify sender [email-masked]
> > before clicking links or attachments
> >
> > Hi All,
> >
> > A Peer Offer Signal MUST be encoded within a UDP packet. The
> > destination
> IP
> > IPv6 Connection Point Data Items in the Peer Offer Signal then the
> > source IP address and UDP port of the packet may be any valid local
> > UDP
> address/port
> > Connection Point Data Items, then the source IP address and UDP port
> > of
> the
> > packet MUST be set to the unicast IP address and TCP port the router
> > MUST
> use
> > when connecting the DLEP TCP session, as defined in Section 7.1.
> > The Peer Offer Signal completes the discovery process.
> > -----
> >
> > Cheers,
> >
> > Rick
> >

---

From: Henning Rogge <[email-masked]>
Date: Sat, 20 Nov 2021 07:02:47 +0100

Wouldn't it be easy to configure the firewall to

Radio (router is the other way around):
ALLOW: outgoing UDP with src-port 854
ALLOW: incoming UDP with dst-port 854

Henning

---

From: "Sipos, Brian J." <[email-masked]>
Date: Mon, 22 Nov 2021 17:37:46 +0000

Yes, but as it stands now neither port is currently required to have any specific value for the Peer Offer signal when a Connection Point item is present.

Below is a text diagram to show the sequence, where RDO-IP and RTR-IP are the unicast addresses and DLEP-MCAST is the multicast address. The router is not required to use any specific UDP or TCP source port, so it will be assigned some ephemeral (EPH#) port by the IP stack. The Peer Offer then will respond back to the router's address+port but its source is left undefined by the current wording. There's no real harm here; it just makes things more challenging for analysis and things like firewalls. I don't see any particular reason why the Peer Offer source port should not be specified, especially because my suspicion is that implementations are already following the send-from-listening-port-number pattern if they're sending datagrams with the same socket used to listen for multicast, and because the source port is specified for when Connection Point is not used.

Radio                       Router
           UDP Exchange
DLEP-MCAST:854 <- RTR-IP:EPH1
RDO-IP:???     -> RTR-IP:EPH1

          TCP Connection
RDO-IP:854     <- RTR-IP:EPH2

-----Original Message-----
From: Henning Rogge <[email-masked]> 
Sent: Saturday, November 20, 2021 1:03 AM
To: Sipos, Brian J. <[email-masked]>
Cc: Rick Taylor <[email-masked]>; [email-masked]
Subject: [EXT] Re: [manet] Proposed text for Errata 6472 (and friends)

APL external email warning: Verify sender [email-masked] before clicking links or attachments 

Henning

On Fri, Nov 19, 2021 at 9:20 PM Sipos, Brian J. <[email-masked]> wrote:
> APL external email warning: Verify sender 
> [email-masked] before clicking links or attachments
>
> Hi Both,
>
> IPv4/6 Connection Point data items contain a port number, so there is 
> no confusion about which port to use to establish the TCP session when 
> the Data Item is included in the response.  The Source IP/port in the 
> response is irrelevant - it just needs to be 'valid' (i.e. not 
> multicast, etc).  The source port can be ephemeral, as nothing is 
> listening for anything further on that port.
>
> When Connection Point data items are missing, set the Source IP/Port 
> of the Peer Offer response packet to the TCP IP/port combo that is 
> listening for the TCP session connect().  In most cases, that will be 
> the same IP address and port (854) as the Discovery UDP is using, so 
> there is little to do programmatically, it's only difficult when the ports are different.
>
> When writing this using the BSD sockets API, a lot of this ephemeral 
> port detail is skipped thanks to the API.  As a modem:
>
> 5b. Else: create a new S2 = socket(UDP) and bind(S2) to DLEP 
> interface, UDP port = custom TCP port, then sendto(S2, Peer offer) to 
> source sockaddr of the received packet.
>
> Does that help?
>
> Cheers,
>
> Rick
>
> > ephemeral port anyways... wouldn't it be the usual thing just use 
> > the same socket for sending the unicast reply?
> >
> > Henning Rogge
> >
> > > For the first condition (connection point is present) there is 
> > > still a lack of preference for UDP port number, which leaves things open.
> > > Can the source
> > UDP
> > > In a typical case, I expect the modem would be listening on 
> > > standard UDP
> > port
> > > address and UDP port of the packet MUST be the source IP address 
> > > and
> > UDP port
> > > of the received Peer Discovery Signal packet.  If the modem 
> > > includes
> > > IPv4 or
> > > source IP address and UDP port of the packet may be any valid 
> > > local UDP
> > address/port
> > > combination.  If the Peer Offer Signal does not include IPv4 or 
> > > IPv6 Connection Point Data Items, then the source IP address and 
> > > UDP port of
> > the
> > > packet MUST be set to the unicast IP address and TCP port the 
> > > router MUST
> > use