| SIMCO header |
+--------------------------+
| authentication challenge | optional
+--------------------------+
| authentication token | optional
+--------------------------+
Figure 19: Structure of SA positive reply
5.2.4. SA Request
The Session Authentication (SA) request message is sent from the
agent to the middlebox after an initial SE request was answered by an
SA reply. The SE request message contains one optional attribute: an
authentication token attribute authenticating the agent as the
response to an authentication challenge sent by the middlebox in an
SA reply.
+--------------------------+
| SIMCO header |
+--------------------------+
| authentication token | optional
+--------------------------+
Figure 20: Structure of SA request
5.2.5. ST Request and ST Positive Reply
The Session Termination (ST) request message is sent from the agent
to the middlebox to request termination of a session. The ST
positive reply is returned, acknowledging the session termination.
Both messages have no attributes and contain the SIMCO header only.
+--------------------------+
| SIMCO header |
+--------------------------+
Figure 21: Structure of ST request and positive reply
5.2.6. SE Negative Replies
There are nine different negative reply messages that can be sent
from a middlebox to the agent if the middlebox rejects an SE request.
Three of them are protocol error negative replies (0x031X) already
covered in Section 4.1.2.
The remaining six negative replies are specific to session
establishment. One of them, the ’protocol version mismatch’ negative
reply (0x0322), contains a single attribute: the protocol version
attribute.
+--------------------------+
| SIMCO header |
+--------------------------+
| SIMCO protocol version |
+--------------------------+
Figure 22a: Structure of SE negative replies
The remaining three replies include ’request not applicable’
(0x0320), ’lack of resources’ (0x0321), ’authentication failed’
(0x0323), ’no authorization’ (0x0324), ’transport protocol problem’
(0x0325), and ’security of underlying protocol layers insufficient’
(0x0326). They consist of the SIMCO header only.
+--------------------------+
| SIMCO header |
+--------------------------+
Figure 22b: Structure of SE negative replies
5.2.7. AST Notification
The Asynchronous Session Termination (AST) notification message is
sent from the middlebox to the agent, if the middlebox wants to
terminate a SIMCO session. It has no attributes and contains the
SIMCO header only.
+--------------------------+
| SIMCO header |
+--------------------------+
Figure 22a: Structure of AST notifications
5.3. Policy Rule Control Messages
Policy Rule control messages include the following list of message
types (composed of basic type and sub-type):
0x0111 : PRR request
0x0112 : PER request
0x0113 : PEA request
0x0114 : PDR request
0x0115 : PLC request
0x0121 : PRS request
0x0122 : PRL request
0x0211 : PRR positive reply
0x0212 : PER positive reply
0x0214 : PDR positive reply
0x0215 : PLC positive reply
0x0216 : PRD positive reply
0x0221 : PRS positive reply
0x0223 : PES positive reply
0x0224 : PDS positive reply
0x0222 : PRL positive reply
0x0310 : negative reply: wrong basic request message type
0x0311 : negative reply: wrong request message sub-type
0x0312 : negative reply: badly formed request
0x0340 : negative reply: transaction not supported
0x0341 : negative reply: agent not authorized for this transaction
0x0342 : negative reply: no resources available for this
transaction
0x0343 : negative reply: specified policy rule does not exist
0x0344 : negative reply: specified policy rule group does not exist
0x0345 : negative reply: not authorized for accessing this policy
0x0346 : negative reply: not authorized for accessing specified
group
0x0347 : negative reply: requested address space not available
0x0348 : negative reply: lack of IP addresses
0x0349 : negative reply: lack of port numbers
0x034A : negative reply: middlebox configuration failed
0x034B : negative reply: inconsistent request
0x034C : negative reply: requested wildcarding not supported
0x034D : negative reply: protocol type doesn’t match
0x034E : negative reply: NAT mode not supported
0x034F : negative reply: IP version mismatch
0x0350 : negative reply: conflict with existing rule
0x0351 : negative reply: not authorized to change lifetime
0x0352 : negative reply: lifetime can’t be extended
0x0353 : negative reply: illegal IP Address
0x0354 : negative reply: protocol type not supported
0x0355 : negative reply: illegal port number
0x0356 : negative reply: illegal NOSP
0x0357 : negative reply: already enable PID
0x0358 : negative reply: parity doesn’t match
0x0401 : negative reply: BFM notification
0x0403 : negative reply: ARE notification
5.3.1. Policy Events and Asynchronous Notifications
SIMCO maintains an owner attribute for each policy rule at the
middlebox. Depending on the configuration of the middlebox, several
agents may access the same policy rule; see also [RFC3989], Sections
2.1.5 and 2.3.4.
To keep all agents synchronized about the state of their policy
rules, SIMCO generates Asynchronous Rule Event (ARE) notifications.
When an agent is reserving or enabling a policy rule, the middlebox
sends an ARE to all agents that are authorized to access this policy
rule. The middlebox sends an ARE to all agents authorized to access
this policy rule when the rule lifetime is modified or if the rule is
deleted.
5.3.2. PRR Request
The Policy Reserve Rule (PRR) request message is sent from the agent
to the middlebox to request reservation of an IP address (and
potentially also a range of port numbers) at the middlebox. Besides
the SIMCO header, the request message contains two or three
attributes. The first one is the PRR parameter set attribute
specifying all parameters of the request except the requested policy
rule lifetime and the group identifier. The missing parameters are
covered by the following two attributes. The last attribute, the
group identifier, is optional.
+--------------------------+
| SIMCO header |
+--------------------------+
| PRR parameter set |
+--------------------------+
| policy rule lifetime |
+--------------------------+
| group identifier | optional
+--------------------------+
Figure 23: Structure of PRR request
5.3.3. PER Request
The Policy Enable Rule (PER) request message is sent from the agent
to the middlebox to request enabling of data communication between an
internal and an external address. Besides the SIMCO header, the
request message contains four or five attributes. The first one is
the PER parameter set attribute specifying all parameters of the
request except the internal address, the external address, the
requested policy rule lifetime, and the group identifier. The
missing parameters are covered by the following four attributes. Two
address tuple parameters specify internal and external address
tuples. Much like the PRR request, the last two attributes specify
the requested lifetime and group identifier. The group identifier
attribute is optional.
+--------------------------+
| SIMCO header |
+--------------------------+
| PER parameter set |
+--------------------------+
| address tuple (internal) |
+--------------------------+
| address tuple (external) |
+--------------------------+
| policy rule lifetime |
+--------------------------+
| group identifier | optional
+--------------------------+
Figure 24: Structure of PER request
5.3.4. PEA Request
The Policy Enable rule After reservation (PEA) request message is
sent from the agent to the middlebox to request enabling of data
communication between an internal and an external address. It is
similar to the PER request. There is just one difference. The
optional group identifier attribute of the PER request is replaced by
a mandatory policy rule identifier attribute referencing an already
established policy reserve rule established by a PRR transaction.
+--------------------------+
| SIMCO header |
+--------------------------+
| PER parameter set |
+--------------------------+
| address tuple (internal) |
+--------------------------+
| address tuple (external) |
+--------------------------+
| policy rule lifetime |
+--------------------------+
| policy rule identifier |
+--------------------------+
Figure 25: Structure of PEA request
The group identifier attribute is not included in the PEA request,
since the group membership of the policy enable rule is inherited of
the policy reserve rule.
5.3.5. PLC Request
The Policy Rule Lifetime Change (PLC) request message is sent from
the agent to the middlebox to request a change of the remaining
policy lifetime. Besides the SIMCO header, the request message
contains two attributes specifying the policy rule to which the
change should be applied and specifying the requested remaining
lifetime.
+--------------------------+
| SIMCO header |
+--------------------------+
| policy rule identifier |
+--------------------------+
| policy rule lifetime |
+--------------------------+
Figure 26: Structure of PLC request
5.3.6. PRS Request
The Policy Rule Status (PRS) request message is sent from the agent
to the middlebox to request a report on the status of a specified
policy rule. Besides the SIMCO header, the request message contains
just one attribute specifying the policy rule for which the report is
requested.
+--------------------------+
| SIMCO header |
+--------------------------+
| policy rule identifier |
+--------------------------+
Figure 27: Structure of PRS request
5.3.7. PRL Request
The Policy Rule List (PRL) request message is sent from the agent to
the middlebox to request a list of all policy rules accessible to the
agent. The message consists of the SIMCO header only.
+--------------------------+
| SIMCO header |
+--------------------------+
Figure 28: Structure of PRL request
5.3.8. PDR Request
The Policy Disable Rule (PDR) request message is sent from the agent
to the middlebox to request a disable rule. The message consists of
the SIMCO header, an internal address tuple, an external address
tuple, and a lifetime attribute.
+--------------------------+
| SIMCO header |
+--------------------------+
| address tuple (internal) |
+--------------------------+
| address tuple (external) |
+--------------------------+
| policy rule lifetime |
+--------------------------+
Figure 29: Structure of PDR request
5.3.9. PRR Positive Reply
The Policy Reserve Rule (PRR) positive reply is sent after successful
reservation of an address at the inside or outside of the middlebox.
The message contains four mandatory attributes and an optional
attribute: the policy rule identifier of the new policy reserve rule,
the corresponding group identifier, the remaining lifetime of the
policy rule, the reserved outside address tuple, and the optional
reserved inside address tuple. The reserved inside address tuple is
only returned when the middlebox is of type twice-NAT.
+--------------------------+
| SIMCO header |
+--------------------------+
| policy rule identifier |
+--------------------------+
| group identifier |
+--------------------------+
| policy rule lifetime |
+--------------------------+
| address tuple (outside) |
+--------------------------+
| address tuple (inside) | optional
+--------------------------+
Figure 30: Structure of PRR positive reply
5.3.10. PER Positive Reply
The Policy Enable Rule (PER) positive reply is sent after the
middlebox successfully enables data transfer between an internal and
an external address (by using a PER or PEA request message). The
message contains five attributes: the policy rule identifier of the
new policy enable rule, the corresponding group identifier, the
remaining lifetime of the policy rule, the address tuple at the
outside of the middlebox, and the address tuple at the inside of the
middlebox.
+--------------------------+
| SIMCO header |
+--------------------------+
| policy rule identifier |
+--------------------------+
| group identifier |
+--------------------------+
| policy rule lifetime |
+--------------------------+
| address tuple (outside) |
+--------------------------+
| address tuple (inside) |
+--------------------------+
Figure 31: Structure of PER positive reply
5.3.11. PLC Positive Reply
The Policy Lifetime Change (PLC) positive reply is sent after the
middlebox changes the lifetime of a policy rule to a positive (non-
zero) value. The message contains just a single attribute: the
remaining lifetime of the policy rule.
+--------------------------+
| SIMCO header |
+--------------------------+
| policy rule lifetime |
+--------------------------+
Figure 32: Structure of PLC positive reply
5.3.12. PRD Positive Reply
The Policy Rule Deleted (PRD) positive reply is sent after the
middlebox changes the remaining lifetime of a policy rule to zero,
which means that it terminates the policy rule. The message consists
of the SIMCO header only.
+--------------------------+
| SIMCO header |
+--------------------------+
Figure 33: Structure of PRD positive reply
5.3.13. PRS Positive Reply
The Policy Reserve Rule Status (PRS) positive reply is used for
reporting the status of a policy reserve rule. The message format is
identical with the format of the PRR positive reply except that it
contains, in addition, a policy rule owner attribute.
+--------------------------+
| SIMCO header |
+--------------------------+
| policy rule identifier |
+--------------------------+
| group identifier |
+--------------------------+
| policy rule lifetime |
+--------------------------+
| address tuple (outside) |
+--------------------------+
| address tuple (inside) | optional
+--------------------------+
| policy rule owner |
+--------------------------+
Figure 34: Structure of PRS positive reply
5.3.14. PES Positive Reply
The Policy Enable Rule Status (PES) positive reply is used for
reporting the status of a policy enable rule.
+--------------------------+
| SIMCO header |
+--------------------------+
| policy rule identifier |
+--------------------------+
| group identifier |
+--------------------------+
| PER parameter set |
+--------------------------+
| address tuple (internal) |