UNUSED or from ENABLED to UNUSED.
A failed request transaction does not change state at the middlebox.
An ARE notification transaction with the lifetime attribute set to
zero has the same effect as a successful PLC transaction with a
lifetime parameter equal to zero.
8.2. Processing PRR Requests
Processing PRR requests is much simpler on pure firewalls than on
middleboxes with NAT functions. Therefore, this section has three
sub-sections: The first one describes initial checks that are
performed in any case. The second sub-section describes processing
of PRR requests on pure firewalls, and the third one describes
processing on all devices with NAT functions.
8.2.1. Initial Checks
When a middlebox receives a PRR request message, it first checks if
the authenticated agent is authorized for requesting reservations.
If not, it returns a negative reply message of type ’agent not
authorized for this transaction’ (0x0341).
If the request contains the optional group identifier, then the
middlebox checks if the group already exists. If not, the middlebox
returns a negative reply message of type ’specified policy rule group
does not exist’ (0x0344).
If the request contains the optional group identifier, then the
middlebox checks if the authenticated agent is authorized for adding
members to this group. If not, the middlebox returns a negative
reply message of type ’not authorized for accessing specified group’
(0x0346).
The middlebox may then check the PRR parameter set. A negative reply
of type ’IP version mismatch’ (0x034F) is returned if the IPi field
does not match the inside IP version of the address at the middlebox.
A negative reply of type ’IP version mismatch’ (0x034F) is returned
if the IPo field does not match the outside IP version of the address
at the middlebox. The requested transport protocol type is checked,
and a negative reply of type ’protocol type not supported’ (0x0354)
is returned if it is not supported. The middlebox may return a
negative reply of type ’requested address space not available’
(0x0347) if the requested address space is completely blocked or not
supported by the middlebox in any way; for example, if a UDP port
number is requested and all UDP packets are blocked by a middlebox
acting as firewall.
The latter check at the middlebox is optional. If the check would
fail and is not performed at this transaction, then two superfluous
transactions will follow. First, the agent will send a request
message for a corresponding PER transaction and will receive a
negative reply on this. Second, either the agent will send a
corresponding PLC request message with lifetime set to zero in order
to delete the reservation, or the reservation will time out and the
middlebox will send an ARE notification message with the lifetime
attribute set to zero. Both transactions can be avoided if the
middlebox initially performs this check.
A reason for avoiding this check might be its complexity. If the
check is passed, the same check will have to be performed again for a
subsequent corresponding PEA request. If processing two more
transactions is considered to consume less resources than performing
the check twice, it might be desirable not to perform it during the
PRR transaction.
After checking the PRR parameter set, the middlebox chooses a
lifetime value for the new policy rule to be created, which is
greater than or equal to zero and less than or equal to the minimum
of the requested value and the maximum lifetime specified by the
middlebox capabilities attribute at session setup. Formally, the
lifetime is chosen such that
0 <= lt_granted <= MINIMUM(lt_requested, lt_maximum)
holds, where ’lt_granted’ is the actual lifetime chosen by the
middlebox, ’lt_requested’ is the lifetime requested by the agent, and
’lt_maximum’ is the maximum lifetime specified during capability
exchange at session setup.
If there are further sessions in state OPEN with authenticated agents
authorized to access the policy rule, then to each of these agents a
corresponding ARE notification with lifetime set to lt_granted is
sent.
If the chosen lifetime is zero, the middlebox sends a negative reply
of type ’middlebox configuration failed’ (0x034A) to the agent.
8.2.2. Processing on Pure Firewalls
If the middlebox is configured as a pure firewall, then it accepts
the request after the initial checks. It establishes a new policy
reserve rule and assigns to it a policy rule identifier in state
RESERVED. It generates a positive PRR reply and sets the attributes
as specified below. No configuration of the firewall function is
required.
The identifier chosen for the new policy rule is reported in the
policy rule identifier attribute of the PRR reply.
If a group identifier attribute is contained in the PRR request, then
the middlebox adds the new policy rule to the members of this group.
If the PRR request does not contain a group identifier attribute,
then the middlebox creates a new group with the new policy rule as
the only member. In any case, the middlebox reports the group of
which the new policy rule is a member in the group identifier
attribute of the PRR reply.
The chosen lifetime is reported in the lifetime attribute of the PRR
reply.
In the address tuple (outside) attribute of the PRR reply, the first
parameter field is set to ’protocols only’ (0x1). Consequently, the
attribute has a length of 32 bits. The IP version parameter field is
set according to the IPo parameter field in the PRR parameter set
attribute of the PRR request message. The prefix length parameter
field is set to 0x00, and the transport protocol parameter field in
the address tuple (outside) attribute of the PRR reply is set
identically to the transport protocol attribute in the PRR parameter
set attribute of the PRR request message. The location parameter
field is set to ’outside’ (0x02).
8.2.3. Processing on Network Address Translators
If the middlebox is configured as a Network Address Translator (NAT),
then it tries to reserve a NAT binding.
The middlebox first checks the PRR parameter set further if the NM
(NAT mode) parameter matches its configuration. A negative reply of
type ’NAT mode not supported’ (0x034E) is returned by the middlebox
if the configuration is not matched.
The following actions are performed, depending on the middlebox NAT
type:
- traditional NAT
A NAT binding at the outside (A2) with the requested transport
protocol, external IP version, port range, and port parity is
reserved.
- twice NAT
A NAT binding at the outside (A2) with the requested transport
protocol, external IP version, port range, and port parity is
reserved. Furthermore, the middlebox reserves an inside (A1) NAT
binding with the requested transport protocol, internal IP
version, port range, and port parity.
The identifier chosen for the new policy rule is reported in the
policy rule identifier attribute of the PRR reply.
After the checks are successfully performed, the middlebox
establishes a new policy reserve rule, with the requested PRR
parameter set, and assigns to it a policy rule identifier in state
RESERVED. It generates a positive PRR reply and sets the attributes
as specified below.
If a group identifier attribute is contained in the PRR request, then
the middlebox adds the new policy rule to the members of this group.
If the PRR request does not contain a group identifier attribute,
then the middlebox creates a new group with the new policy rule as
the only member. In any case, the middlebox reports the group of
which the new policy rule is a member in the group identifier
attribute of the PRR reply.
The chosen lifetime is reported in the lifetime attribute of the PRR
reply.
In the address tuple (outside) attribute of the PRR reply, the first
parameter field is set to ’full addresses’ (0x0). The location
parameter field is set to ’outside’ (0x02). The IP version parameter
field is set according to the IPo parameter field in the PRR
parameter set attribute of the PRR request message. For IPv4
addresses, the prefix length field is set to 0x20 to indicate a full
address, and the reserved outside IPv4 address is set in the address
field. For IPv6 addresses, the prefix length field is set to 0x80 to
indicate a full address, and the reserved outside IPv6 address is set
in the address field. The transport protocol parameter field in the
address tuple (outside) attribute of the PRR reply is set identically
to the transport protocol attribute in the PRR parameter set
attribute of the PRR request message. The reserved outside base port
number (i.e., the lowest port number of the allocated range) is
stored in the port number parameter field, and the allocated port
range is stored in the port range parameter field.
If the NM (NAT mode) parameter in the PRR parameter set attribute of
the PRR request message has the value ’traditional’, then the PRR
reply message does not contain an address tuple (inside) attribute.
If otherwise (it has the value ’twice’), then the PRR reply message
contains an address tuple (inside) attribute. In the address tuple
(inside) attribute of the PRR reply, the first parameter field is set
to ’full addresses’ (0x0). The location parameter field is set to
’inside’ (0x01). The IP version parameter field is set according to
the IPi parameter field in the PRR parameter set attribute of the PRR
request message. For IPv4 addresses, the prefix length field is set
to 0x20 to indicate a full address, and the reserved inside IPv4
address is set in the address field. For IPv6 addresses, the prefix
length field is set to 0x80 to indicate a full address, and the
reserved inside IPv6 address is set in the address field. The
transport protocol parameter field in the address tuple (inside)
attribute of the PRR reply is set identically to the transport
protocol attribute in the PRR parameter set attribute of the PRR
request message. The reserved inside base port number (i.e., the
lowest port number of the allocated range) is stored in the port
number parameter field, and the allocated port range is stored in the
port range parameter field.
8.3. Processing PER Requests
Processing PER requests is much simpler on pure firewalls than on
middleboxes with NAT functions. Therefore, this section has three
sub-sections: The first one describes initial checks that are
performed in any case. The second sub-section describes processing
of PER requests on pure firewalls, and the third one describes
processing on all devices with NAT functions.
8.3.1. Initial Checks
When a middlebox receives a PER request message, it first checks if
the authenticated agent is authorized for requesting middlebox
configurations for enabling communication. If not, it returns a
negative reply message of type ’agent not authorized for this
transaction’ (0x0341).
If the request contains the optional group identifier, then the
middlebox checks if the group already exists. If not, the middlebox
returns a negative reply message of type ’specified policy rule group
does not exist’ (0x0344).
If the request contains the optional group identifier, then the
middlebox checks if the authenticated agent is authorized for adding
members to this group. If not, the middlebox returns a negative
reply message of type ’not authorized for accessing specified group’
(0x0346).
Then the middlebox checks the contained address tuple attributes.
If the first one does not have the location parameter field set to
’internal’ (0x00), or if the second one does not have the location
parameter field set to ’external’ (0x03), then the middlebox returns
a negative reply message of type ’inconsistent request’ (0x034B).
If the transport protocol parameter field does not have the same
value in both address tuple attributes, then the middlebox returns a
negative reply message of type ’inconsistent request’ (0x034B).
If both address tuple attributes contain a port range parameter
field, if both port range parameter fields have values not equal to
0xFFFF, and if the values of both port range parameter fields are
different, then the middlebox returns a negative reply message of
type ’inconsistent request’ (0x034B).
Then the agent checks if wildcarding is requested and if the
requested wildcarding is supported by the middlebox. Wildcarding
support may be different for internal address tuples and external
address tuples. The following parameter fields of the address tuple
attribute can indicate wildcarding:
- the first parameter field
If it is set to ’protocols only’ (0x1), then IP addresses and
port numbers are completely wildcarded.
- the transport protocol field
If it is set to 0x00, then the transport protocol is completely
wildcarded. Please note that a completely wildcarded transport
protocol might still support only a limited set of transport
protocols according to the capabilities of the middlebox. For
example, a typical NAT implementation may apply transport
wildcarding to UDP and TCP transport only. Wildcarding the
transport protocol implies wildcarding of port numbers. If this
field is set to 0x00, then the values of the port number field
and the port range field are irrelevant.
- the prefix length field
If the IP version number field indicates IPv4 and the value of
this field is less than 0x20, then IP addresses are wildcarding
according to this prefix length. If the IP version number field
indicates IPv6 and the value of this field is less than 0x80,
then IP addresses are wildcarding according to this prefix
length. If the first parameter field is set to ’protocols only’
(0x1), then the value of the prefix length field is irrelevant.
- the port number field
If it is set to zero, then port numbers are completely
wildcarded. In this case, the value of the port range field is
irrelevant.
If any of these kinds of wildcarding is used, and if this is in
conflict with wildcarding support for internal or external addresses
of the middlebox, then the middlebox returns a negative reply message
of type ’requested wildcarding not supported’ (0x034C).
Please note that the port range field cannot be used for wildcarding.
If it is set to a value greater than one, then middlebox
configuration is requested for all port numbers in the interval
starting with the specified port number and containing as many
consecutive port numbers as specified by the parameter.
If the direction parameter field in the PER parameter set attribute
has the value ’bi-directional’, then only transport protocol
wildcarding is allowed. If any other kind of wildcarding is
specified in one or both of the IP address tuple attributes, then the
middlebox returns a negative reply message of type ’inconsistent
request’ (0x034B).
If the PER request conflicts with any policy disable rule (see
Section 8.8.1), then the middlebox returns a negative reply message
of type ’conflict with existing rule’ (0x0350).
After checking the address tuple attributes, the middlebox chooses a
lifetime value for the new policy rule to be created, which is
greater than or equal to zero and less than or equal to the minimum
of the requested value and the maximum lifetime specified by the
middlebox capabilities attribute at session setup. Formally, the
lifetime is chosen such that
0 <= lt_granted <= MINIMUM(lt_requested, lt_maximum)
holds, where ’lt_granted’ is the actual lifetime chosen by the
middlebox, ’lt_requested’ is the lifetime requested by the agent, and
’lt_maximum’ is the maximum lifetime specified during capability
exchange at session setup.
If there are further sessions in state OPEN with authenticated agents
authorized to access the policy rule, then to each of these agents a
corresponding ARE notification with lifetime set to lt_granted is
sent.
If the chosen lifetime is zero, the middlebox sends a negative reply
of type ’middlebox configuration failed’ (0x034A) to the agent.
8.3.2. Processing on Pure Firewalls
If the middlebox is acting as a pure firewall, then it tries to
configure the requested pinhole. The firewall configuration ignores
the port parity parameter field in the PER parameter set attribute,
but it considers the direction parameter field in this attribute.
The pinhole is configured such that communication between the
specified internal and external address tuples is enabled in the
specified direction and covering the specified wildcarding. If the
configuration fails (for example, because the pinhole would conflict
with high-level firewall policies), then the middlebox returns a
negative reply message of type ’middlebox configuration failed’
(0x034A).
If the configuration was successful, the middlebox establishes a new
policy enable rule and assigns to it a policy rule identifier in
state ENABLED. It generates a positive PER reply and sets the
attributes as specified below.
The identifier chosen for the new policy rule is reported in the
policy rule identifier attribute of the PER reply.
If a group identifier attribute is contained in the PER request, then
the middlebox adds the new policy rule to the members of this group.
If the PRR request does not contain a group identifier attribute,
then the middlebox creates a new group with the new policy rule as
the only member. In any case, the middlebox reports the group of
which the new policy rule is a member in the group identifier
attribute of the PER reply.
The chosen lifetime is reported in the lifetime attribute of the PER
reply.
The address tuple (internal) attribute of the PER request is reported
as address tuple (outside) attribute of the PER reply. The address
tuple (external) attribute of the PER request is reported as address
tuple (inside) attribute of the PER reply.
8.3.3. Processing on Network Address Translators
If the middlebox is configured as a NAT, then it tries to configure
the requested NAT binding. The actions taken by the NAT are quite
similar to the actions of the Policy Reserve Rule (PRR) request, but
in the PER request a NAT binding is enabled.
The following actions are performed, depending on the middlebox NAT
type:
- traditional NAT
A NAT binding is established between the internal and external
address tuple with the requested transport protocol, port range,
direction, and port parity. The outside address tuple is
created.
- twice NAT
A NAT binding is established between the internal and external
address tuple with the requested transport protocol, port range,
and port parity. But two address tuples are created: an outside
address tuple and an inside address tuple.
Should the configuration fail in either NAT case, a negative reply
’middlebox configuration failed’ (0x034A) is returned.
If the configuration was successful, the middlebox establishes a new
policy enable rule and assigns to it a policy rule identifier in
state ENABLED. It generates a positive PER reply and sets the
attributes as specified below.
The identifier chosen for the new policy rule is reported in the
policy rule identifier attribute of the PER reply.
If a group identifier attribute is contained in the PER request, then
the middlebox adds the new policy rule to the members of this group.
If the PRR request does not contain a group identifier attribute,
then the middlebox creates a new group with the new policy rule as
the only member. In any case, the middlebox reports the group of
which the new policy rule is a member in the group identifier
attribute of the PER reply.
The chosen lifetime is reported in the lifetime attribute of the PER
reply.
In the address tuple (outside) attribute of the PER reply, the first
parameter field is set to ’full addresses’ (0x0). The location
parameter field is set to ’outside’ (0x02). The IP version parameter
field is set according to the IP version parameter field in the PER
parameter set attribute of the PER request message. For IPv4
addresses, the prefix length field is set to 0x20 to indicate a full
address, and the reserved outside IPv4 address is set in the address
field. For IPv6 addresses, the prefix length field is set to 0x80 to
indicate a full address, and the reserved outside IPv6 address is set
in the address field. The transport protocol parameter field in the
address tuple (outside) attribute of the PER reply is set identically
to the transport protocol attribute in the PER parameter set
attribute of the PER request message. The reserved outside base port
number (i.e., the lowest port number of the allocated range) is
stored in the port number parameter field, and the allocated port
range is stored in the port range parameter field.
The address tuple (inside) is only returned if the middlebox is a
twice NAT; otherwise, it is omitted. In the address tuple (inside)
attribute of the PER reply, the first parameter field is set to ’full
addresses’ (0x0). The location parameter field is set to ’inside’
(0x01). The IP version parameter field is set according to the IP
version parameter field in the PER parameter set attribute of the PER
request message. For IPv4 addresses, the prefix length field is set
to 0x20 to indicate a full address, and the reserved inside IPv4
address is set in the address field. For IPv6 addresses, the prefix
length field is set to 0x80 to indicate a full address, and the
reserved inside IPv6 address is set in the address field. The
transport protocol parameter field in the address tuple (inside)
attribute of the PER reply is set identically to the transport
protocol attribute in the PER parameter set attribute of the PER
request message. The reserved inside base port number (i.e., the
lowest port number of the allocated range) is stored in the port
number parameter field, and the allocated port range is stored in the
port range parameter field.
8.3.4. Processing on Combined Firewalls and NATs
Middleboxes that are combinations of firewalls and NATs are
configured in such a way that first the NAT bindings are configured
and afterwards the firewall pinholes. This sequence is needed since
the firewall rules must be configured according to the outside
address tuples and for twice NATs the inside address tuples as well.
This aspect of middlebox operation may be irrelevant to SIMCO, since
some NATs already do firewall configuration on their own.
8.4. Processing PEA Requests
Processing PEA requests is much simpler on pure firewalls than on
middleboxes with NAT functions. Therefore, this section has three
sub-sections: The first one describes initial checks that are
performed in any case. The second sub-section describes processing
of PEA requests on pure firewalls, and the third one describes
processing on all devices with NAT functions.
8.4.1. Initial Checks
When a middlebox receives a PEA request message, it first checks if
the authenticated agent is authorized for requesting middlebox
configurations for enabling communication. If not, it returns a
negative reply message of type ’agent not authorized for this
transaction’ (0x0341).
Then the middlebox checks the policy rule identifier attribute
contained in the PEA message. If no policy rule with this identifier
exists, then the middlebox returns a negative reply message of type
’specified policy rule does not exist’ (0x0343). If there exists a
policy with this identifier and if it is in a state other than
RESERVED, then the middlebox returns a negative reply message of type
’inconsistent request’ (0x034B).
If a policy rule with this identifier exists, but the authenticated
agent is not authorized for terminating this policy reserve rule,
then the middlebox returns a negative reply message of type ’agent