Subject: [multipathtcp] Connection ID and NAT

From: "Martin Becke" <[email-masked]>
Date: Wed, 3 Mar 2010 16:22:10 +0100

Hi all,

I'm new to mptcp and I'm just starting to understand the concepts of the
approach. 
I discussed some points internal and I'm not sure how the "connection id"
will work, especially in the context of NAT. 

For my understanding it is just a randomly generated ID to identify the
connection:

Application  <--> Internal (Stack) <--> Network/Endpoint
------------------------------------------------------
5-tuple      <--> [address pairs]  <--> Connection ID

So if I think about a scenario with two endpoints (EP) behind a NAT
(middlebox), how could the destination handle data from multiple addresses
of different or what's about the JOIN option?  
For example using the same destination, the source ports are equal and also
the randomly generated "Connection ID" (ID A= ID B => special case think,
but however)....

EP1 Connection ID A ------>
                           |
                           NAT ---------> DST: 
                           |
EP2 Connection ID B ------> 

Is there another connection identification mechanism I didn't catch? For my
understanding using a randomly generated connection ID is not enough behind
a NAT.
  
In case we generate a connection ID  based on the source address more than
32 bit is necessary (especially for IPv6 more than 64 bit). 

Or is this discussed as a special case, with a special behavior (also with
focus on security)? 

Can somebody clarify this?

Thanks a lot!

Martin Becke

---

From: "Ford, Alan" <[email-masked]>
Date: Wed, 3 Mar 2010 17:40:52 -0000

Hi Martin,

Some clarifications inline, I hope they help...

> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]] On
> Behalf Of Martin Becke
> Sent: 03 March 2010 15:22
> To: [email-masked]
> Subject: [multipathtcp] Connection ID and NAT
> 
> Hi all,
> 

A pair of connection IDs at an endpoint (the local and the remote
connection IDs) will map to any number of active TCP subflows, each of
which will have a different 5-tuple.

> EP2 Connection ID B ------>

In this case, if EP1 and EP2 are initiating separate connections to the
same destination port, each will use a different local token in its MPC
option in the SYN. Since the destination address and port is the same,
but the source port will be different, the DST will see these as the two
separate connections that they are, and will send different Connection
IDs back in its own MPC option in the SYN/ACK. When the two endpoints
want to set up new subflows from different source addresses, they'll
each have different Connection IDs (given by DST) to use in the JOIN.

Each of these connections that are set up will have a different source
port, and thus the 5-tuples of the initial subflows will be different.
The different 5-tuples will map to different Connection ID pairs at DST,
and thus will be treated as different connections.

I don't see that there is a problem here. Have I misunderstood your
scenario?

Regards,
Alan

---

From: "Martin Becke" <[email-masked]>
Date: Wed, 3 Mar 2010 20:42:55 +0100

Hi Alan,

I'd say you hit the bull's eye!
Thanks a lot for the explanation.
Now I catch the point fully :D

Regards,
Martin

-----Ursprüngliche Nachricht-----
Von: [email-masked] [mailto:[email-masked]] Im
Auftrag von Ford, Alan
Gesendet: Mittwoch, 3. März 2010 18:41
An: Martin Becke; [email-masked]
Betreff: Re: [multipathtcp] Connection ID and NAT

Hi Martin,

Regards,
Alan

_______________________________________________
multipathtcp mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/multipathtcp