Draft: draft-ietf-masque-connect-ip

Commentary: let 's discuss that on . I 'd like to merge this PR first then decide on a plan for before submitting the next revision to the datatracker 
 Splitting { ADDRESSREQUESTROUTEADVERTISEMENT } into ... V4 and ... _ V6 would result in smaller capsules that have fewer error conditions . It would also keep IPv4 and IPv6 logic distinct . 
 I do n't think the size of these capsules matters given their rarity . I can see the error condition argument but it 's pretty minor and would come at the cost of making the specification longer . I do n't feel too strongly here , but I think I have a slight preference for keeping things as they are . 
 I agree with  that size is problem not a big concern . I think having one set of capsule is less complex . 
 I also have a preference for keeping the capsules as they are with versions included ; it also allows the route advertisement capsule to include routes for both v4 and v6 in one capsule , which I think is very important . I would n't want to lose that feature . 
 I similarly have a preference for keeping v4 and v6 in one capsule and agree size is not a big concern . 
 I just chatted with to see what error conditions he was thinking of . Upon discussion ( v6 route advertised when only v4 address is available ) , we concluded that this is not an error case , it 's just a route that 's not yet usable . We 've concluded that this is something that we 're comfortable leaving as - is . 
 Implementing this on the client I was wondering if there should be a way for the client to ask for the server for an address without specifying what address it wants . This could allow a VPN client to mention that it wants an IPv6 address or not . If we think this could be useful , we could encode it as or . 
 I believe asking for the Any address is what we discussed previously , so +1 
 You mean ADDRESS_REQUEST(IPv4 - 0.0.0.0/32 ) do n't you . I think the format of the request works fine . But we do need to before we implement this into the specification . 
 Yes — if we have this , one option is to always have an ADDRESS_REQUEST expected from clients , and then there does n't need to be signaling . Or we do the simple solution to 54 to say " I expect to send N capsules with my request " . 
 You 're right this could be a potential solution to . Let 's discuss them together tomorrow 
 Regarding IPv6 , I think a standard request that would make sense is asking for any /64 . I guess that works fine with this idea too ? 
 Oh that 's interesting , if the IP Address is or , the prefix length is a hint for the requested length . I like that . 
 IETF 114 : Add an editorial sentence to " remember , what you ask for may not be what you get , especially with regards to address families " . A request should be paired with a response , multiple requests can just say " you have the same ones you had before " . Clarify that it 's cumulative . Also solves unassign / removal of addresses . 
 So there appear to exist some downside with the timing of the interactions when one want to use Address - Request capsule . So the basic problem is simply that the proxy will assign an address prior to the Address - Request capsule has been received , thus preventing the proxy from processing the request in the right context . So lets assume that the client has already created one connect - IP request with a limited scope and been assigned IP - A. Then it want to make an additional request for another limited scope proxying and would like to get the same address assigned . Due to the separation between the HTTP request for the Connect - IP and the capsule Address - Request a server can actually process the whole HTTP request prior to receiving the Address - Request . Resulting potentially in that another IP address assignment ( IP - B ) be provided to the client , despite it asking for IP - A to be assigned also to the request . So does the HTTP request needs an indicator parameter to tell the proxy to wait for one or more " request " capsules from the client before processing the request ? 
 Out of curiosity , in what scenario would the client " like to get the same address assigned " ? It makes sense for the proxy to decide to reuse addresses to save its address pool when the scoping allows it , but why would the client care ? 
 I could imagine this happening if the client was trying to resume some previous session that it lost due to an outage ? Seems to be niche , but it 's certainly possible . 
 So the most obvious use case for this is to request iproto= CMP in combination with for example UDP . Then getting ICMP for another IP address then the one you already have UDP for is mostly useless if you intended to use the ICMP messages for hints when things fails for you UDP based protocol . I would note that for an endpoint liking to do P2P NAT traversal stuff getting an IP address rather than using Connect - UDP does make sense as it ensure the client has control . It enables the IP address for its UDP traffic to be Endpoint - Independent Mapping ( RFC4787 ) . This might be niche usages but I would like to avoid creating artificial barriers that makes things impossible or at least hard to realise . 
 Thanks , this makes sense . Should we suggest that clients bundle the ADDRESS_REQUEST in the same packet as the HTTP headers and suggest that servers check for those before responding ? 
 I am still worried that this creates issues as your request may not fit in a single packet to begin with . My solution would be to actually move the address request part into the HTTP request itself as header field . That would ensure an atomic operation and no risk for errors . 
 Magnus , is your proposal to require , or to allow as an option , for the address request to be moved into the HTTP request ? Why not bundle the capsules over a reliable delivery mechanism instead ? 
 I first of all want to ensure that you can do a request that ensures that for those cases when it is necessary to interpret the Connect - IP request in the context of desired IP address it can done . Without uncertainties or requiring to have wait time to see if there are capsules incoming . So I think primarily allow as an option . I think a question back to your usages , do you have cases where one would need additional capsules to correctly interpret the option . Should we look for an other solution than the one I proposed to better cover the necessary functionality ? 
 I want to be able to continue to do ADDRESS_ASSIGN capsules during the lifetime of the connection to support e.g. , IPv6 Privacy extensions but without having to delegate the entire subnet . So I do n't want to move to header - only . 
 I think is describing something similar to the / capsules that we had in the original Google . The only difference is that we would add an HTTP header to say " start off in atomic mode and wait for atomic end before sending addresses and such " . While I think this does sound useful , does it need to be in the core spec or could it be an extension ? 
 Is there any reason to not bring back the capsules ? 
 The only reason I can think of is to keep the core spec as short and simple as possible . But if we think this is an important feature then I 'm not opposed to bringing back . 
 I agree with the sentiment of keeping the core spec short and simple , but the trade - off is also knowing what the minimum viable featureset we can always rely on is . If we conclude that capsules are in that set , that IMHO weighs towards including them . Given that both Magnus and I have now presented use - cases for atomicity , I think this finally swings towards including ? 
 I agree with that 
 So why I used atomic here , was due to the split between HTTP and  . So I do n't see this issue currently motivates the need for  capsules . I really would prefer that the necessary parameters for the CONNECT - IP request are in the HTTP request , either in the URI or in an HTTP field . To be clear , I understand the need for the capsules as they are useful for doing things after the initial request , but creating this binding between the HTTP request and the capsules are creating its sets of complexities . Likely bigger than duplicating the carrying of the necessary information results in , especially when they may be use cases related . 
 I agree I with Magnus and think we should specify a ay to add the address request to the http request . If there is a timing dependency it 's better to put all needed information into the same request than specifying extra and complex logic to achieve the same in hindsight . That does n't mean that we do n't need the address request capsule ( for later use in the connection ) . I think we need both . 
 I dislike having two ways of conveying the same thing . How about a simple HTTP header that tells the receiver that there are 4 capsules coming right after the HTTP headers ? 
 I 'd prefer to avoid " atomic capsule " starts and ends . If we need a way to guarantee inclusion of the local address in the first request , having it be in the HTTP request makes sense , either as another URI parameter , a header to say what address you want , or a header to say you will have capsules that need to be parsed before responding . That latter option is flexible , certainly , but could be over - engineered . Another option is to tightly scope a header to the use case we think is relevant . If the use case is " please use the same address as this other request stream I already have for connect - ip or connect - UDP " , we could just have a header to say for any connect- request that it is entangled with another and should share some properties . I could imagine this even without CONNECT - IP . Today with private relay , we have to ask the proxies to prefer to use the same local IP for everything in a connection from the client , but letting the client choose what gets grouped might be even nicer . This option also lets you issue multiple requests , say they should share , without needing to know exactly which IP any of them will get assigned first . 
 Unfortunately requests and headers are end - to - end but streams are hop - by - hop so there is no easy HTTP way to have a request refer to another request . I 'd be supportive of adding the header but I 'd push back on adding a header that duplicates a capsule . This is starting to feel like something best - served by an extension 
 You could solve the correlation by having a " group " ID that you attach to all related requests . No need to refer by stream ID . 
 What is the scope of a group ID ? Connection ? If so it 's the same as stream IDs . 
 I think this should be some extension , but it could be a UUID too , does n't need to be connection specific . 
 Ah , thanks . Yeah UUID would work . Back to the issue at hand , I propose this feature request get moved to an extension . 
 All of these alternatives strike me as much more complex that the semantics of . I 'd rather we have a single mechanism even if it 's slightly more powerful and restrain it 's use than try to invent new ways to solve each problem that arises . 
 Atomic does n't help coordinate between requests on different streams , etc , so it 's not really solving the full problem here . Either way , I think this is something to defer to an extension . 
  do n't solve that problem either , so I 'm not sure that argument really makes sense in this context . Cross stream coordination seems out of scope to me . 
 So you are taking this into directions I did not intended . I am just asking for how to ensure that the server does not answers the client 's request prior to having received any capsules if they are coming . And the real issue is that the server ca n't know unless the client either includes the corresponding data in the HTTP request or includes an indication that there will be capsules that are relevant to the requests . So , my main worry is if waiting for capsule to answer will actually work if there are an HTTP 1.x intermediary connection on the path between the client and the server . I guess its is sending the capsule after the request and hope it makes it . Because to my understanding in HTTP datagram the peer does not expect any data to arrive so it must be upgraded . Thus , one can end up in cases where the capsule protocol does not make it , where the HTTP request does arrive . 
 While we might want to have a more generic extension to relate information to multiple requests , I think the problem Magnus describes needs a solution now . The problem is that there is a dependency between replying / react to a connect request and potentially information send in capsules . The best solution is to send this information together with the connection request instead . I do n't see any concern to have a http request or URI parameter and the capsule . What 's the problem about that ? 
 Magnus , what is " the client 's request " here ? Is it the extended - connect itself , or a response to a capsule ? If it 's the former , the server ca n't know what capsules , if any , are coming at this time , as we have n't yet established we are using the capsule protocol . If it 's the latter , capsules trivially solve this , as you can not process any of the requests until the capsule is received .  , I 'd like to avoid having 2 ways to do things , especially since putting it on the HTTP request is a less - generic mechanism and can not be reused during the connection , whereas capsules can . If we believe this feature is important , I 'd like us to solve it generically , rather than special - casing one use case we are aware of right now . 
 So the client 's request is the HTTP request that is only complete in semantics when combined with the request - address capsule . 
 Sorry Magnus , I 'm not sure I understand what you 're trying to say . I do n't think we can enforce a semantic that a higher - level HTTP request is only complete after some bytes on the then - negotiated protocol have been exchanged . 
 But this is really the issue , there is currently no way for a client to ask the server to only provide a targeted connect - IP forwarding if the IP address it can provide is the one the client asks for in a consistent way . My interpretation of the specification is that either ; 1 ) the server will never take the request - addr into account initially for the request , and interpret the request - addr after it has created a Connect - IP forwarding 2 ) the server will sometime take the request - addr into account by have a short delay awaiting for the request - addr capsule , which may or may not make it in time for the implementation specific timer . This non - consistency or failure to address a use case that I think several was interested in resolving is a real problem . A problem I think we will have to take with us to the meeting . 
 This ultimately stems from us not having an explicit capsule / message to indicate that forwarding should actually begin . Right now it 's implicit as soon as the capsule is assembled with the IP addressing information . This is leading to your proposal to stick more things onto the initial request , whereas I believe the correct solution is to add more capabilities to the capsule protocol to express these scenarios . 
 I will consider what you are saying . However , I will note that we might have different goals . I do have a need for identifiable streams that can be referred to in extension signalling . Using capsules does not achieve that with the current design as the stream identifier comes from the HTTP request , not the subsequent capsule signalling . 
 I hope so , constructive discussion relies on all of us considering what the others are saying Given that we 're all trying to solve slightly different problems here , I see two outcomes : we have one simple generic solution that happens to work for everyone we punt this to more specific extensions since these problems are not generic 
 So I think the issue here is what we consider core functionality . My observation here is that  is promoting functionality that will make it easy to make quite rich things for the network tunnelling use case that you are promoting . While I am bringing up something that to me appear core for the single endpoint tunnelling . So I think we actually need to understand the issues as well as what usage and how usable this is in common and how to handle where the different use cases actually benefits from having the functionality in different places . 
 I 'll reiterate my suggestion from the meeting : it would be better to have IP - version - specific capsule types for each capsule . It saves a byte and also avoids problems with version mismatches . Thanks ! I left 2 minor editorial questions , but feel free to merge as - is .
Paragraph (version A):
The ADDRESS_ASSIGN capsule (see iana-types for the value of the
capsule type) allows an endpoint to inform its peer that it has
assigned an IP address or prefix to it.  The ADDRESS_ASSIGN capsule
allows assigning a prefix which can contain multiple addresses.  Any
of these addresses can be used as the source address on IP packets
originated by the receiver of this capsule.
Paragraph (version A):
If an endpoint receives multiple ADDRESS_ASSIGN capsules, all of the
assigned addresses or prefixes can be used.  For example, multiple
ADDRESS_ASSIGN capsules are necessary to assign both IPv4 and IPv6
addresses.
Paragraph (version A):
In some deployments of CONNECT-IP, an endpoint needs to be assigned
an address by its peer before it knows what source address to set on
its own packets.  For example, in the Remote Access case (example-
remote) the client cannot send IP packets until it knows what address
to use.  In these deployments, endpoints need to send ADDRESS_ASSIGN
capsules to allow their peers to send traffic.
Paragraph (version A):
The ADDRESS_REQUEST capsule (see iana-types for the value of the
capsule type) allows an endpoint to request assignment of an IP
address from its peer.  This capsule is not required for simple
client/proxy communication where the client only expects to receive
one address from the proxy.  The capsule allows the endpoint to
optionally indicate a preference for which address it would get
assigned.
Paragraph (version A):
Upon receiving the ADDRESS_REQUEST capsule, an endpoint SHOULD assign
an IP address to its peer, and then respond with an ADDRESS_ASSIGN
capsule to inform the peer of the assignment.
Paragraph (version B):
The ADDRESS_ASSIGN capsule (see iana-types for the value of the
capsule type) allows an endpoint to inform its peer of the list of IP
addresses or prefixes it has assigned to it.  Every capsule contains
the full list of IP prefixes currently assigned to the receiver.  Any
of these addresses can be used as the source address on IP packets
originated by the receiver of this capsule.
Paragraph (version B):
The ADDRESS_ASSIGN capsule contains a sequence of zero or more
Assigned Addresses.
Paragraph (version B):
Note that an ADDRESS_ASSIGN capsule can also indicate that a
previously assigned address is no longer assigned.  An ADDRESS_ASSIGN
capsule can also be empty.
Paragraph (version B):
In some deployments of CONNECT-IP, an endpoint needs to be assigned
an address by its peer before it knows what source address to set on
its own packets.  For example, in the Remote Access case (example-
remote) the client cannot send IP packets until it knows what address
to use.  In these deployments, the endpoint that is expecting an
address assignment MUST send an ADDRESS_REQUEST capsule.  This isn't
required if the endpoint does not need any address assignment, for
example when it is configured out-of-band with static addresses.
Paragraph (version B):
While ADDRESS_ASSIGN capsules are commonly sent in response to
ADDRESS_REQUEST capsules, endpoints MAY send ADDRESS_ASSIGN capsules
unprompted.
Paragraph (version B):
The ADDRESS_REQUEST capsule (see iana-types for the value of the
capsule type) allows an endpoint to request assignment of IP
addresses from its peer.  The capsule allows the endpoint to
optionally indicate a preference for which address it would get
assigned.
Paragraph (version B):
The ADDRESS_REQUEST capsule contains a sequence of Requested
Addresses.
Paragraph (version B):
If the IP Address is all-zero (0.0.0.0 or ::), this indicates that
the sender is requesting an address of that address family but does
not have a preference for a specific address.  In that scenario, the
prefix length still indicates the sender's preference for the prefix
length it is requesting.
Paragraph (version B):
Upon receiving the ADDRESS_REQUEST capsule, an endpoint SHOULD assign
an IP address to its peer, and then respond with an ADDRESS_ASSIGN
capsule to inform the peer of the assignment.  Note that the receiver
of the ADDRESS_REQUEST capsule is not required to assign the
requested address, and that it can also assign some requested
addresses but not others.
Paragraph (version A):
Clients MAY optimistically start sending proxied IP packets before
receiving the response to its IP proxying request, noting however
that those may not be processed by the proxy if it responds to the
request with a failure, or if the datagrams are received by the proxy
before the request.
Paragraph (version B):
Clients MAY optimistically start sending proxied IP packets before
receiving the response to its IP proxying request, noting however
that those may not be processed by the proxy if it responds to the
request with a failure, or if the datagrams are received by the proxy
before the request.  Since receiving addresses and routes is required
in order to know that a packet can be sent through the tunnel, such
optimistic packets might be dropped by the proxy if it chooses to
provide different addressing or routing information than what the
client assumed.
Paragraph (version B):
Extensions to CONNECT-IP can define behavior changes to this
mechanism.  Such extensions SHOULD define new capsule types to
exchange configuration information if needed.  It is RECOMMENDED for
extensions that modify addressing to specify that their extension
capsules be sent before the ADDRESS_ASSIGN capsule and that they do
not take effect until the ADDRESS_ASSIGN capsule is parsed.  This
allows modifications to address assignement to operate atomically.
Similarly, extensions that modify routing SHOULD behave similarly
with regards to the ROUTE_ADVERTISEMENT capsule.