Subject: [multipathtcp] Two proxy scenario (network proxy off path) - far end connection initiation?

From: <[email-masked]>
Date: Wed, 29 Mar 2017 16:34:13 +0000

<<I'm now thinking about the scenario where there are two proxies, one in the home gateway or Customer Premises Equipment and one in the network, both under the control of the operator. And looking at the 'explicit mode' scenario, which - if I get it right - means that the network proxy is not on the default path. (It's safe to assume that the home gateway proxy is on the default path)>>

In this scenario, do we assume that the TCP connection is always initiated by the endpoint that's behind the home gateway, or do we also handle connections initiated by the other end?  The former is the main case

I couldn't see anything about the latter in the drafts - think I remember some discussion on the list, but I can't find it (please just send a pointer if already resolved)

Thanks
phil

---

From: <[email-masked]>
Date: Wed, 29 Mar 2017 18:11:08 +0000

Re-, 

Please see inline.

Cheers,
Med

> -----Message d'origine-----
> De : multipathtcp [mailto:[email-masked]] De la part de
> [email-masked]
> Envoyé : mercredi 29 mars 2017 11:34
> À : [email-masked]
> Objet : [multipathtcp] Two proxy scenario (network proxy off path) - far
> end connection initiation?
> 
> <<I'm now thinking about the scenario where there are two proxies, one in
> the home gateway or Customer Premises Equipment and one in the network,
> both under the control of the operator. And looking at the 'explicit mode'
> scenario, which - if I get it right - means that the network proxy is not
> on the default path. (It's safe to assume that the home gateway proxy is
> on the default path)>>
> 
> In this scenario, do we assume that the TCP connection is always initiated
> by the endpoint that's behind the home gateway, or do we also handle
> connections initiated by the other end?  The former is the main case

[Med] The MPTCP connection can be initiated from both ends.

> 
> I couldn't see anything about the latter in the drafts - think I remember
> some discussion on the list, but I can't find it (please just send a
> pointer if already resolved)

[Med] You can check slide 7 of https://www.ietf.org/proceedings/95/slides/slides-95-mptcp-1.pdf or https://tools.ietf.org/html/draft-boucadair-mptcp-plain-mode-08#section-4.4.2.  
 
> 
> Thanks
> phil
> 
> _______________________________________________
> multipathtcp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/multipathtcp

---

From: <[email-masked]>
Date: Thu, 30 Mar 2017 15:03:19 +0000

If I get it right, the assumption here is that for a TCP connection initiated from the remote end point , the remote network proxy is on path.  (in the other direction we're assuming the remote proxy is off path, so seems a bit odd?)

I think there's also the assumption that the local endpoint (in the home) has previously made a connection out which has instantiated state in the remote proxy. So in this scenario, when the TCP SYN from the remote end point hits the remote proxy, then the remote proxy knows which home gateway the other end is on. Or something like that - to be honest, I couldn't understand the slide /section of the draft. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: 29 March 2017 13:11
To: Eardley,PL,Philip,TUB8 R <[email-masked]>; [email-masked]
Subject: RE: Two proxy scenario (network proxy off path) - far end connection initiation?

Re-, 

Please see inline.

Cheers,
Med

> [email-masked] Envoyé : mercredi 29 mars 2017 11:34 À : 
> [email-masked] Objet : [multipathtcp] Two proxy scenario 
> (network proxy off path) - far end connection initiation?
> 
> <<I'm now thinking about the scenario where there are two proxies, one 
> in the home gateway or Customer Premises Equipment and one in the 
> network, both under the control of the operator. And looking at the 'explicit mode'
> scenario, which - if I get it right - means that the network proxy is 
> not on the default path. (It's safe to assume that the home gateway 
> proxy is on the default path)>>
> 
> In this scenario, do we assume that the TCP connection is always 
> initiated by the endpoint that's behind the home gateway, or do we 
> also handle connections initiated by the other end?  The former is the 
> main case

> 
> I couldn't see anything about the latter in the drafts - think I 
> remember some discussion on the list, but I can't find it (please just 
> send a pointer if already resolved)

---

From: Olivier Bonaventure <[email-masked]>
Date: Thu, 30 Mar 2017 17:19:56 +0200

> If I get it right, the assumption here is that for a TCP connection initiated from the remote end point , the remote network proxy is on path.  (in the other direction we're assuming the remote pro…

This is related to the fact that if the downstream MCP operates in 
explicit mode, then it performs NAT. Typically, the MCP has a block of 
public IP addresses that it uses for the clients that it serves. All 
external packets destined to any of these addresses are routed to the MCP.

> I think there's also the assumption that the local endpoint (in the home) has previously made a connection out which has instantiated state in the remote proxy. So in this scenario, when the TCP SY…

There is an assumption that either there is a one-to-one mapping between 
the client addresses and the public addresses used by the MCP or the 
client has configured some port mapping rules, e.g. with PCP on the dMCP 
and the uMCP

Olivier

---

From: <[email-masked]>
Date: Thu, 30 Mar 2017 15:28:51 +0000

Re,

Please see inline.

Cheers,
Med

> De : [email-masked] [mailto:[email-masked]]
> Envoyé : jeudi 30 mars 2017 10:03
> À : BOUCADAIR Mohamed IMT/OLN; [email-masked]
> Objet : RE: Two proxy scenario (network proxy off path) - far end
> connection initiation?
> 
> If I get it right, the assumption here is that for a TCP connection
> initiated from the remote end point , the remote network proxy is on path.

[Med] No. 

> (in the other direction we're assuming the remote proxy is off path, so
> seems a bit odd?)
> 
> I think there's also the assumption that the local endpoint (in the home)
> has previously made a connection out which has instantiated state in the
> remote proxy.

[Med] Not necessarily sending a connection out to the same remote peer. The assumption is that a state is created on the proxy to prepare for incoming connections by means specific protocols such as PCP (RFC6887). BTW, this is exactly the same concern for e2e MPTCP connections when a firewall or a NAT is on the path. The same tools to create that state for the e2e MPTCP case can be reused in the case of the proxy connection. 

 So in this scenario, when the TCP SYN from the remote end
> point hits the remote proxy, then the remote proxy knows which home
> gateway the other end is on.

[Med] Yes

 Or something like that - to be honest, I
> couldn't understand the slide /section of the draft.

[Med] The text says: 

   In order to appropriately handle incoming SYN packets, the
   concentrator (resp.  CPE) are supposed to be configured with
   instructions that allows to redirect the traffic to the appropriate
   CPE (resp.  Internal host). 

> [Med] You can check slide 7 of
> https://www.ietf.org/proceedings/95/slides/slides-95-mptcp-1.pdf or
> https://tools.ietf.org/html/draft-boucadair-mptcp-plain-mode-08#section-
> 4.4.2.
> 
> >
> > Thanks
> > phil
> >

---

From: Yoshifumi Nishida <[email-masked]>
Date: Thu, 30 Mar 2017 10:58:57 -0700

Hmm.  But, I am not very sure if we really need to think about this case at
this moment.
It seems to me there are too many assumptions to make this work and it
doesn't look very scalable (I'm not sure how to maintain such public IP
address table)
If we don't see strong demands to support this case, I think it might be
better put aside it for the time being.
--
Yoshi

On Thu, Mar 30, 2017 at 8:19 AM, Olivier Bonaventure <
[email-masked]> wrote:

>> remote proxy. So in this scenario, when the TCP SYN from the remote end
>> point hits the remote proxy, then the remote proxy knows which home gateway
>> the other end is on. Or something like that - to be honest, I couldn't
>> understand the slide /section of the draft.
>>
>
> the client addresses and the public addresses used by the MCP or the client
> has configured some port mapping rules, e.g. with PCP on the dMCP and the
> uMCP
>
>
> Olivier
>
>

---

From: <[email-masked]>
Date: Thu, 30 Mar 2017 20:04:45 +0000

Hi Yoshi,

Please see inline.

Cheers,
Med

De : Yoshifumi Nishida [mailto:[email-masked]]
Envoyé : jeudi 30 mars 2017 12:59
À : [email-masked]
Cc : philip.eardley; BOUCADAIR Mohamed IMT/OLN; multipathtcp
Objet : Re: [multipathtcp] Two proxy scenario (network proxy off path) - far end connection initiation?

Hmm.  But, I am not very sure if we really need to think about this case at this moment.

It seems to me there are too many assumptions to make this work and
[Med] The tools to make this work are the same as for end-to-end MPTCP when firewalls, NAT64, DS-Lite AFTR, CGN, NPTv6, etc. are on the path.

it doesn't look very scalable (I'm not sure how to maintain such public IP address table)
[Med] PCP on the CGN is a deployment reality…

If we don't see strong demands to support this case, I think it might be better put aside it for the time being.
[Med] I’m neutral on this. Our proposal allows to cover both in/out connections with the same object (MP_CONVERT IE). If you don’t think that MPTCP should be symmetric, then the same conclusion will apply for proxyied connections.

--
Yoshi

On Thu, Mar 30, 2017 at 8:19 AM, Olivier Bonaventure <[email-masked]<mailto:[email-masked]>> wrote:
On 30/03/17 17:03, [email-masked]<mailto:[email-masked]> wrote:
If I get it right, the assumption here is that for a TCP connection initiated from the remote end point , the remote network proxy is on path.  (in the other direction we're assuming the remote proxy is off path, so seems a bit odd?)

This is related to the fact that if the downstream MCP operates in explicit mode, then it performs NAT. Typically, the MCP has a block of public IP addresses that it uses for the clients that it serves. All external packets destined to any of these addresses are routed to the MCP.
I think there's also the assumption that the local endpoint (in the home) has previously made a connection out which has instantiated state in the remote proxy. So in this scenario, when the TCP SYN from the remote end point hits the remote proxy, then the remote proxy knows which home gateway the other end is on. Or something like that - to be honest, I couldn't understand the slide /section of the draft.

There is an assumption that either there is a one-to-one mapping between the client addresses and the public addresses used by the MCP or the client has configured some port mapping rules, e.g. with PCP on the dMCP and the uMCP

Olivier

_______________________________________________
multipathtcp mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/multipathtcp