Subject: [shara] dynamic allocation of port ranges in draft-bajko-v6ops-port-restricted-ipaddr-assign

From: "Dan Wing" <[email-masked]>
Date: Wed, 11 Mar 2009 17:40:40 -0700

I was pleased to see the new "Dynamic allocation of port ranges" section in 
draft-ymbk-aplusp-03.  While digging into the details a bit, I saw in
Section 4.2 of draft-bajko-v6ops-port-restricted-ipaddr-assign-02:

   When the server detects that a client with a specific hardware
   address, having already been allocated with a port restricted IP
   address, sent another DHCPDISCOVER, it MAY, based on local policy,
   offer the client with additional port restricted IP address.
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

I interpret the highlighted phrase to mean the PRR provides a range of 
ports on a *different* IP address.  Is that the intent?  I had expected 
that sentence in the I-D to conclude with "... offer the client 
additional ports on the same IP address as previously allocated."

-d

---

From: <[email-masked]>
Date: Tue, 17 Mar 2009 02:05:06 +0100

>ports on a *different* IP address.  Is that the intent?  

The intention was to say that the server may allocate an additional set of ports, which may belong to the same or different IP address.

  >Is that the intent?  I had expected

Yes, that would simplify considerably both the client and server operation. I can add a clarification that the server should allocate additional ports belonging to the same IP address (if possible).

- gabor

  >-----Original Message-----
  >From: [email-masked] [mailto:[email-masked]] On Behalf Of
  >ext Dan Wing
  >Sent: Wednesday, March 11, 2009 5:41 PM
  >To: [email-masked]
  >Subject: [shara] dynamic allocation of port ranges in draft-bajko-v6ops-
  >port-restricted-ipaddr-assign
  >
  >_______________________________________________
  >shara mailing list
  >[email-masked]
  >https://www.ietf.org/mailman/listinfo/shara

---

From: "Dan Wing" <[email-masked]>
Date: Mon, 16 Mar 2009 18:16:21 -0700

> The intention was to say that the server may allocate an 
> additional set of ports, which may belong to the same or 
> different IP address.
> 
> Yes, that would simplify considerably both the client and 
> server operation. I can add a clarification that the server 
> should allocate additional ports belonging to the same IP 
> address (if possible).

It has to or else some applications will fail.  Passive FTP
will break if the FTP server requires the IP connection from
the same IP address as the control channel (see 
http://cr.yp.to/ftp/security.html for a discussion).  I 
understand that some HTTP applications have a similar 
requirement.  This is all because, on today's Internet, IPv4
address = identity, and if a host's connections start appearing 
on different IPv4 addresses at the same time then some 
applications deem it is a new 'identity' (because it is a new
IPv4 address).

This is captured in REQ-1 of 
http://tools.ietf.org/html/draft-nishitani-cgn-01,

   REQ-1: A LSN MUST allocate one external IP address to each CPE.

      a) LSN external IP address of the UDP, TCP and ICMP MUST be same.

-d

>   >From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of
>   >ext Dan Wing
>   >I was pleased to see the new "Dynamic allocation of port 
> ranges" section
>   >in