Subject: Re: [MBONED] AMT draft

From: "ALTOM, MARK W (ATTLABS)" <[email-masked]>
Date: Mon, 1 Mar 2010 10:18:14 -0500

In order to support the proposal of the new AMT command 
(Type 7: Teardown Request), additional modifications are 
needed to the Draft in order for the AMT Gateway to 
populate the fields of the Teardown Request properly.   

When an AMT Gateway resides downstream of a NAT device, it 
does not know the IP address / Port number combination actually 
used to communicate with the AMT Relay.  In other words, the AMT 
Gateway's end of the AMT Tunnel.  As a result, that information 
needs to be passed from the entity that knows the information 
(the AMT Relay) to the AMT Gateway.  Passing the additional 
information on the AMT Relay Advertisement, seems to be the most 
logical place.  

Using the new Teardown Request as a model, the following 
formats are proposed for the AMT Relay Advertisement packet.

NOTE: An AFI value of 0 was chosen to indicate that the 
Gateway Address/Port Number values are NOT present.  As a result, 
the length of the AMT Relay Advertisement packet should be used 
to determine the Address Family of the Relay Address.  This is to 
support the existing behavior/format.  
                           
Example 1: AMT Relay Advertisement (IPv4), Gateway Address/Port 
number NOT present 

    0              1               2               3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type=2    |    Reserved   |            AFI=0              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Discovery Nonce                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                      Relay Address                            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Example 2: AMT Relay Advertisement (IPv6), Gateway Address/Port 
number NOT present 

    0              1               2               3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type=2    |    Reserved   |            AFI=0              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Discovery Nonce                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                                                               +
   |                                                               |
   +                      Relay Address                            +
   |                                                               |
   +                                                               +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   
Example 3: AMT Relay Advertisement (IPv4), Gateway Address/Port 
number present 

    0              1               2               3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type=2    |    Reserved   |            AFI=1              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Discovery Nonce                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                      Relay Address                            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Gateway Address                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |    Gateway Port Number        |   
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Example 4: AMT Relay Advertisement (IPv6), Gateway Address/Port 
number present 

    0              1               2               3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type=2    |    Reserved   |            AFI=2              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Discovery Nonce                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                                                               +
   |                                                               |
   +                      Relay Address                            +
   |                                                               |
   +                                                               +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                                                               +
   |                                                               |
   +                     Gateway Address                           +
   |                                                               |
   +                                                               +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |    Gateway Port Number        |   
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Please let us know if you have questions or if you need additional
details.
Thanks,
Tom Imburgia
Mark Altom
Tom Blahuta
Roger Elliott
Andy Huang
Pat McCrink
Han Nguyen
Doug Nortz
AT&T Labs
(Contact: Mark Altom, [email-masked], +1 732 420 9073)  

-----Original Message-----
From: ALTOM, MARK W (ATTLABS) 
Sent: Tuesday, February 23, 2010 4:54 PM
To: 'Dave Thaler'
Cc: [email-masked]; [email-masked]; Dino Farinacci
Subject: RE: [MBONED] AMT draft

Dave, 

We have taken into account the suggestions/recommendations you provided
with respect to the Response MAC and the use of a Nonce value in the 
Teardown Request.  

After combined discussions with Dino Farinacci from Cisco, we are both 
in agreement with the implementation/interpretation that follows.  

Please let us know if you have any questions/concerns regarding our 
interpretations. 

Since there is no response to the Teardown Request, we must assume 
that the Nonce value suggested, would be the Request Nonce from the 
most recent AMT Request sent by the Gateway.   

Given that the Response MAC in the Teardown Request is the value from 
the most recent AMT Membership Query packet sent by the Relay (in 
response to the Gateway's AMT Request), and was generated using the 
Request Nonce, this makes perfect sense.

Therefore, it is our understanding that the Teardown Requests would 
be formatted as follows:  
        
Example 1: Teardown Request sent from Gateway IP address currently 
associated with the AMT Tunnel

    0              1               2               3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type=7    |                Reserved                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Request Nonce                             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Response MAC . . .                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  . . . Response MAC           |      Gateway Port Number      |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |           AFI=0               |                                
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                                

Example 2: Teardown Request sent from Gateway IP address different than 
the IP address associated with the AMT Tunnel (IPv4) 

    0              1               2               3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type=7    |                Reserved                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Request Nonce                             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Response MAC . . .                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  . . . Response MAC           |      Gateway Port Number      |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |           AFI=1               |   Gateway IP Address . . .    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   | . . . Gateway IP Address      |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Example 3: Teardown Request sent from Gateway IP address different than 
the IP address associated with the AMT Tunnel (IPv6) 
   
    0              1               2               3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type=7    |                Reserved                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Request Nonce                             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Response MAC . . .                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  . . . Response MAC           |      Gateway Port Number      |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |           AFI=2               |                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               +
   |                                                               |
   +                                                               +
   |                      Gateway IP Address                       |
   +                                                               +
   |                                                               |
   +                               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

In all examples, the Request Nonce is the value from the most recent 
AMT Request packet; sent from the associated Gateway to the Relay during

the last AMT Request/Query/Update exchange.  

In addition, the Response MAC is the value from the most recent AMT 
Membership Query packet; sent from the Relay to the associated Gateway 
during the same AMT Request/Query/Update exchange. 

The Relay will only honor the Teardown Request if the Response MAC 
matches the value previously sent to the Gateway, and successfully 
validates the Response MAC using the following:  

- The Gateway IP address provided in the Teardown Request; except in
example 1 
  above, where the IP address the packet originated from would be used
- The Gateway Port Number in the Teardown Request
- The Request Nonce in the Teardown Request
- The Relay's Local Secret 

There will be no response sent to the Teardown Request from the Relay.  

We believe the primary purpose of the Teardown Request is to provide a 
simple (yet secure) method of freeing resources when abnormal conditions

occur, which cause the AMT Tunnel to no longer be useable.  For example,

when the IP address changes on the Gateway itself.   

However, we also see a large benefit in using the Teardown Request (as
in 
example 1 above) to quickly remove state information in both the Relay
and 
Gateway, with an implied "leave-all". 

Please let us know if you have questions or if you need additional
details.
Thanks,
Tom Imburgia
Mark Altom
Tom Blahuta
Roger Elliott
Andy Huang
Pat McCrink
Han Nguyen
Doug Nortz
AT&T Labs
(Contact: Mark Altom, [email-masked], +1 732 420 9073)  

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Dave Thaler
Sent: Thursday, February 18, 2010 7:43 PM
To: Dino Farinacci
Cc: [email-masked]; [email-masked]
Subject: Re: [MBONED] AMT draft

Section 5.1.2:
   The receiving side
   (the respondent) can calculate a message authentication code (MAC)
   based on (for example) the source IP address of the Request, the
   source UDP port, the request nonce, and a secret key known only to
   the respondent.

Section 5.1.3:
   o  When the Gateway receives the AMT Query message it responds by
      copying the security code from the AMT Query message into a AMT
      Membership Update message.  The Update message contains (S1,G1) in
      an IGMPv3/MLDv2 formatted packet with an IP header.  The nonce
      from the AMT Request is also included in the AMT Membership Update
      message.

Section 6.5:
   The same Request Nonce and Response MAC can be used across multiple
   AMT Membership Update messages without having to send individual AMT
   Membership Query messages.

Section 6.5.4:
   The same Request Nonce and Response MAC can be used across multiple
   AMT Membership Update messages without having to send individual AMT
   Membership Query messages.

So putting the above together, you should see that a membership update
needs to include both the nonce and the MAC.  The relay needs the nonce
to be able to verify the MAC without requiring it to track MAC/nonce
state.
The Teardown message format below contains a MAC but no Nonce, which
is inconsistent with the Update.

If you add a nonce field to the teardown, and change the logic in 5.1.2
to use the embedded gateway IP/port in case of a Teardown, instead of 
the source IP/port from which the teardown was received, then I think 
this would be secure.  However, I still think it should contain an IGMP
Leave.  And once it does that then it's the same as a Membership
Update except with a few new fields.

-Dave

> -----Original Message-----
> From: Dino Farinacci [mailto:[email-masked]]
> Sent: Thursday, February 18, 2010 4:18 PM
> To: Dave Thaler
> Cc: [email-masked]; [email-masked]
> Subject: Re: [MBONED] AMT draft
> 
> > Which of those fields contains something an attacker can't easily
> > guess?
> 
> Why don't I put some words behind the packet format.  ;-)
> 
> The Gateway will return the last Response Nonce that the Relay sent to
> it in the Teardown Request message.
> 
> The relay will make sure the Gateway Address embedded in the Teardown
> Request message is the one that it has tunnel state for and has the
> Response Nonce cached for.
> 
> Dino
> 
> >
> > From: Greg Shepherd [mailto:[email-masked]]
> > Sent: Thursday, February 18, 2010 12:43 PM
> > To: Dave Thaler
> > Cc: Tom Pusateri; [email-masked]
> > Subject: Re: [MBONED] AMT draft
> >
> > Exactly. So send all the relevant info.
> >
> > A format like this for the "Teardown Request":
> >
> > 0                   1                   2                   3
> >  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> > |     Type=7    |     Reserved                                  |
> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> > |                     Response MAC . . .                        |
> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> > |  . . . Response MAC           |    Gateway Port Number        |
> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> > |       Gateway Address AFI     |    Gateway Address . . .      |
> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> > |                   . . . Gateway Address AFI                   |
> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> >
> >
> > On Thu, Feb 18, 2010 at 12:33 PM, Dave Thaler
> > <[email-masked]> wrote:
> > As Tom said, securing the Leave is key.
> > So far I haven't seen an acceptable proposal here other than the
> > normal one Tom
> > mentions.
> >
> > If you want to send a Leave from one interface that would be
> > interpreted the
> > same as if you sent it from another interface which has already gone
> > away, you
> > can't just send it and expect the relay to accept it since it cannot
> > distinguish this
> > from an attack.  So you need a nonce or equivalent mechanism before
> > this would
> > be acceptable.
> >
> > -Dave
> >
> > From: [email-masked] [mailto:[email-masked]] On
> > Behalf Of Greg Shepherd
> > Sent: Thursday, February 18, 2010 12:02 PM
> > To: Tom Pusateri
> > Cc: [email-masked]
> > Subject: Re: [MBONED] AMT draft
> >
> >
> >
> > On Thu, Feb 18, 2010 at 11:08 AM, Tom Pusateri <[email-masked]>
> > wrote:
> > This should probably be discussed on the list.
> >
> > Agreed.
> >
> > Under normal operations, the AMT gateway should leave the group on
> > the old interface through the normal AMT Request/Query/Update
> > procedure.
> >
> > Yes, that would be normal. Not all conditions are 'normal'. ;-)
> >
> > In many cases, the old interface will still be around and
> > operational. You really want to use the nonce mechanism to keep
> > anyone from being able to teardown other people's tunnels.
> >
> > And in some cases it is not.
> >
> > What is the concern?
> >
> > Are you concerned about the gateway is getting the stream twice and
> > can't handle the bandwidth?
> >
> > That. Unnecessary bandwidth as well as Relay state.
> >
> > Greg
> >
> > Thanks,
> > Tom
> >
> > On Feb 18, 2010, at 1:38 PM, Greg Shepherd wrote:
> >
> > > Tom,
> > >
> > > An implementer of AMT has raised an important deployment scenario
> > which requires a news message type. The issue arises when you have a
> > GW with one network connection, then switches to another (Wifi ->
> > wired, native->VPN, etc..). The Relay may continue sending to the
> > old IP of the GW for minutes before the state times out.
> > >
> > > What they've proposed is a message from the GW which contains the
> > relevant info for the relay to terminate the previous tunnel and
> > state. Then the GW can begin again with a discovery.
> > >
> > > Make sense?
> > >
> > > A format like this for the "Teardown Request":
> > >
> > > 0                   1                   2                   3
> > >  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
> > > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> > > |     Type=7    |     Reserved                                  |
> > > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> > > |                     Response MAC . . .                        |
> > > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> > > |  . . . Response MAC           |    Gateway Port Number        |
> > > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> > > |       Gateway Address AFI     |    Gateway Address . . .      |
> > > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> > > |                   . . . Gateway Address AFI                   |
> > > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> > >
> > > May I have the doc token to make add this?
> > >
> > > Thanks,
> > > Greg
> >
> >
> >
> > _______________________________________________
> > MBONED mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/mboned
> 

_______________________________________________
MBONED mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mboned