Subject: Re: [MBONED] AMT Draft - Proposal for new Teardown and Advertisement Messages

From: "ALTOM, MARK W (ATTLABS)" <[email-masked]>
Date: Mon, 14 Jun 2010 10:14:09 -0400

At the Mboned session during the March IETF meetings in Anaheim, one of 
the agenda items was a proposal for a new teardown message in the 
AMT internet draft.  At the conclusion of this agenda item, the plan 
was to take further discussion to the Mboned mail list.

Background on the proposal for new Teardown Message and modified 
Advertisement Message:

Problem Description:

A typical scenario for an AMT GW is that it will reside on a PC behind a
NAT device (e.g. broadband modem/router and/or home router).   The
broadband bandwidth available varies significantly between users and
over time.   

The problem that we are attempting to solve is to reduce/eliminate 
duplicate streams sent to the NAT device in the case when the PC's local

interface is interrupted, which may result in the NAT port changing.
For example, this could happen if the user switches from a wired to a
Wi-Fi connection.   It is possible that this change could also result in
the NAT IP address changing (e.g. if switches to a different NAT device 
or if local interface got interrupted due to a reboot of the NAT
device).   However, it is also possible that the NAT IP address may stay
constant.

The GW can detect a local interface interruption and start the
Discovery, and 3-way handshake with the same (or a new) Relay.   At the
same time, the old Relay will stop receiving the 3-way handshakes from
the old address/port and can eventually time out this old GW.   However,
during this time period, it is possible that the end user will be
receiving 
duplicate streams down to their NAT device.  Given that broadband links 
are often congested and this is UDP traffic, the experience for the end
user 
may be degraded until the Relay times out the old GW.

Proposed Solution:

Since the GW is aware of the local interface interruption, it can inform

its old Relay to stop forwarding packets by using the proposed Teardown
message, thereby eliminating duplicate streams to the NAT device.   The
proposed method has the GW using its current address/port as the source 
and including the old source address/port within the body of the message

(see "Modified AMT Relay Advertisement message" below for method that GW

uses to determine its source address/port as perceived by the Relay).

It is true that the NAT device can also change its public IP address
without 
interrupting the local interface (and therefore without the GW
noticing).   In this case, since the GW is unaware of change, it cannot
send the Teardown message.   The Relay may send a duplicate stream until
it times out the old GW.   However, in this case, the duplicate stream
will not get routed to the NAT device since it has changed its address
and 
will likely get Null routed by the ISPs upstream router.
Therefore, from a user-perspective, this does not degrade performance
and 
does not fall into the problem that we are attempting to solve.

The format for the new Teardown Requests would be as follows:  
        
Example 1: Teardown Request sent from Gateway IP address currently 
associated with the AMT Tunnel

    0              1               2               3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type=7    |                Reserved                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Request Nonce                             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Response MAC . . .                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  . . . Response MAC           |      Gateway Port Number      |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |           AFI=0               |                                
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                                

Example 2: Teardown Request sent from Gateway IP address different than 
the IP address associated with the AMT Tunnel (IPv4) 

    0              1               2               3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type=7    |                Reserved                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Request Nonce                             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Response MAC . . .                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  . . . Response MAC           |      Gateway Port Number      |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |           AFI=1               |   Gateway IP Address . . .    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   | . . . Gateway IP Address      |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Example 3: Teardown Request sent from Gateway IP address different than 
the IP address associated with the AMT Tunnel (IPv6) 
   
    0              1               2               3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type=7    |                Reserved                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Request Nonce                             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Response MAC . . .                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  . . . Response MAC           |      Gateway Port Number      |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |           AFI=2               |                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               +
   |                                                               |
   +                                                               +
   |                      Gateway IP Address                       |
   +                                                               +
   |                                                               |
   +                               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

In all examples, the Request Nonce is the value from the most recent 
AMT Request packet; sent from the associated Gateway to the Relay 
during the last AMT Request/Query/Update exchange.  

In addition, the Response MAC is the value from the most recent AMT 
Membership Query packet; sent from the Relay to the associated Gateway 
during the same AMT Request/Query/Update exchange. 

The Relay will only honor the Teardown Request if the Response MAC
matches 
the value previously sent to the Gateway, and successfully validates the

Response MAC using the following:  

- The Gateway IP address provided in the Teardown Request; except in
  example 1 above, where the IP address the packet originated from would
  be used
- The Gateway Port Number in the Teardown Request
- The Request Nonce in the Teardown Request
- The Relay's Local Secret 

There will be no response sent to the Teardown Request from the Relay.  

We believe the primary purpose of the Teardown Request is to provide a
simple 
(yet secure) method of freeing resources when abnormal conditions occur,
which 
cause the AMT Tunnel to no longer be useable.  For example, when the IP
address 
changes on the Gateway itself.   

However, we also see a large benefit in using the Teardown Request (as
in 
example 1 above) to quickly remove state information in both the Relay
and 
Gateway, with an implied "leave-all". 

Modified AMT Relay Advertisement message: 

In order to support the proposal of the new AMT command (Type 7:
Teardown Request),
additional modifications are needed to the Draft in order for the AMT
Gateway 
to populate the fields of the Teardown Request properly.   

When an AMT Gateway resides downstream of a NAT device, it does not know
the 
IP address / Port number combination actually used to communicate with
the AMT Relay.  
In other words, the AMT Gateway's end of the AMT Tunnel.  As a result,
that 
information needs to be passed from the entity that knows the
information 
(the AMT Relay) to the AMT Gateway.  Passing the additional information
on 
the AMT Relay Advertisement, seems to be the most logical place.  

Using the new Teardown Request as a model, the following formats are
proposed 
for the AMT Relay Advertisement packet.

NOTE: An AFI value of 0 was chosen to indicate that the Gateway
Address/Port Number 
values are NOT present.  As a result, the length of the AMT Relay
Advertisement packet 
should be used to determine the Address Family of the Relay Address.  
This is to support the existing behavior/format.  
                           
Example 1: AMT Relay Advertisement (IPv4), Gateway Address/Port number
NOT present 

    0              1               2               3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type=2    |    Reserved   |            AFI=0              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Discovery Nonce                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                      Relay Address                            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Example 2: AMT Relay Advertisement (IPv6), Gateway Address/Port number
NOT present 

    0              1               2               3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type=2    |    Reserved   |            AFI=0              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Discovery Nonce                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                                                               +
   |                                                               |
   +                      Relay Address                            +
   |                                                               |
   +                                                               +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   
Example 3: AMT Relay Advertisement (IPv4), Gateway Address/Port number
present 

    0              1               2               3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type=2    |    Reserved   |            AFI=1              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Discovery Nonce                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                      Relay Address                            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Gateway Address                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |    Gateway Port Number        |   
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Example 4: AMT Relay Advertisement (IPv6), Gateway Address/Port number
present 

    0              1               2               3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type=2    |    Reserved   |            AFI=2              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Discovery Nonce                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                                                               +
   |                                                               |
   +                      Relay Address                            +
   |                                                               |
   +                                                               +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                                                               +
   |                                                               |
   +                     Gateway Address                           +
   |                                                               |
   +                                                               +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |    Gateway Port Number        |   
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Requirements of Solution:
AT&T is not committed to the proposed solution.  However, any workable
solution:

* must work with legacy broadband modem/router, home routers, etc.   
* must not significantly increase processing required by GW (PC)
* must be scalable in Relay
* should be secure to the extent possible

Sincerely,

Mark Altom
Andy Huang
Tom Imburgia
Pat McCrink
Han Nguyen
Doug Nortz
AT&T Labs