Basic Host Identity Protocol (HIP) Extensions for Traversal of Network Address Translators
draft-ietf-hip-nat-traversal-09

[Ballot comment]
Section 4.7:

HIP relay servers MAY refrain
  from sending keepalives if it's known that they are not behind a
  middlebox that requires keepalives.

As it appears to be an assumption that the Relay server is not behind a NAT I don't see any meaning in the relay sending keep-alives. That as NATs normally only do keep-alive from their inside. And as that is mandated their are no point in the server on the external side to initiate keep-alive messages.

[Ballot comment]
I'm happy to see this work progress, and I welcome it being published as Experimental.

Please consider adding some text to the document to discuss the scope of the experiment. What concerns are there about releasing this into the Internet (i.e., why the Experiment)? How is the experiment limited (i.e., what rules ensure that this is operating within some kind of wall)? How will you determine if the experiment is a success?

[Ballot comment]
I support the last issue raised by Jari in his DISCUSS concerning the need for a default value for the transaction pacing value parameter.

[Ballot discuss]
This is overall nice document, and believe it should be published
as an RFC. However, I had two question marks that I wanted to
talk about before recommending approval. The document says:

  If a host is going to use ICE, it needs to gather a set of address
  candidates.  The candidate gathering SHOULD be done as defined in
  Section 4.1 of [I-D.ietf-mmusic-ice].  Candidates need to be gathered
  for only one media stream and component.

I'm troubled by the use of the term media stream. Is this a term
defined in ICE, and if so, how does it translate to general purpose
IP layer operation, such as what HIP is doing? Or is this merely a
matter of saying that media stream = the UDP encapsulated flow that
HIP is using to go through NATs?

The document says:

  For this purpose, during the base exchange, hosts can negotiate a
  transaction pacing value, Ta, using a TRANSACTION_PACING parameter in
  R1 and I2 packets.  The parameter contains the minimum time
  (expressed in milliseconds) the host would wait between two NAT
  traversal transactions, such as starting a new connectivity check or
  retrying a previous check.  If a host does not include this parameter
  in the base exchange, a Ta value of 500ms MUST be used as that host's
  minimum value.  The value that is used by both of the hosts is the
  higher out of the two offered values.

  Hosts SHOULD NOT use values smaller than 20ms for the minimum Ta,
  since such values may not work well with some NATs, as explained in
  [I-D.ietf-mmusic-ice].  The Initiator MUST NOT propose a smaller
  value than what the Responder offered.

  The minimum Ta value SHOULD be configurable.

The connectivity check storms are not just an issue for the hosts
themselves, they are also an issue for the network as well as those
other hosts that failed probes may end up with. Given this, I believe
it would be useful to make a slightly stronger statement above
about the configuration. For instance, that Ta 500 ms MUST be
the default unless there's explicit configuration that says otherwise.
(The current text says something slightly different, namely that
lack of the value in the protocol exchange implies 500 ms. But it
does not say anything about what the default config needs to be.)

[Ballot discuss]
The document says:

  If a host is going to use ICE, it needs to gather a set of address
  candidates.  The candidate gathering SHOULD be done as defined in
  Section 4.1 of [I-D.ietf-mmusic-ice].  Candidates need to be gathered
  for only one media stream and component.

I'm troubled by the use of the term media stream. Is this a term
defined in ICE, and if so, how does it translate to general purpose
IP layer operation, such as what HIP is doing?

The document says:

  For this purpose, during the base exchange, hosts can negotiate a
  transaction pacing value, Ta, using a TRANSACTION_PACING parameter in
  R1 and I2 packets.  The parameter contains the minimum time
  (expressed in milliseconds) the host would wait between two NAT
  traversal transactions, such as starting a new connectivity check or
  retrying a previous check.  If a host does not include this parameter
  in the base exchange, a Ta value of 500ms MUST be used as that host's
  minimum value.  The value that is used by both of the hosts is the
  higher out of the two offered values.

  Hosts SHOULD NOT use values smaller than 20ms for the minimum Ta,
  since such values may not work well with some NATs, as explained in
  [I-D.ietf-mmusic-ice].  The Initiator MUST NOT propose a smaller
  value than what the Responder offered.

  The minimum Ta value SHOULD be configurable.

The connectivity check storms are not just an issue for the hosts
themselves, they are also an issue for the network as well as those
other hosts that failed probes may end up with. Given this, I believe
it would be useful to make a slightly stronger statement above
about the configuration. For instance, that Ta 500 ms MUST be
the default unless there's explicit configuration that says otherwise.
(The current text says something slightly different, namely that
lack of the value in the protocol exchange implies 500 ms. But it
does not say anything about what the default config needs to be.)

[Ballot comment]
Section 50500, paragraph 0:
>    Upon publication of this document, IANA is requested to register a
>    UDP port and the RFC editor is requested to change all occurrences of
>    port HIPPORT to the port IANA has registered.  The HIPPORT number
>    50500 should be used for initial experimentation.

  I believe you want to remove the sentence about port 50500, because
  that was only intended to be used while there was no registered port.
  (Also, I assume you want a Registered port > 1024 and not a Well Known
  port, correct?)

IANA questions/comments:

Please see our question about Action 5.

Upon approval of this document, IANA will complete the following:

ACTION 1:

New assignment in the well-known port numbers registry at
http://www.iana.org/assignments/port-numbers

Keyword Decimal Description References
------- ------- ----------- ----------
hip TBD/udp Host Identity Protocol
[RFC-hip-nat-traversal-08]


ACTION 2:

New assignments in the "Parameter Types" registry at
at http://www.iana.org/assignments/hip-parameters/hip-parameters.xhtml

Value Parameter Type Length Reference
----- ------------------ ------- ---------
63998 RELAY_FROM 20 [RFC-hip-nat-traversal-08]
64002 RELAY_TO 20 [RFC-hip-nat-traversal-08]
950 REG_FROM 20 [RFC-hip-nat-traversal-08]
65520 RELAY_HMAC variable [RFC-hip-nat-traversal-08]
610 TRANSACTION_PACING 4 [RFC-hip-nat-traversal-08]
608 NAT_TRAVERSAL_MODE variable [RFC-hip-nat-traversal-08]


ACTION 3:

New assignment in the "Registration Types" registry at
at http://www.iana.org/assignments/hip-parameters/hip-parameters.xhtml

Value Registration Type Reference
----- ------------------ ---------
2 RELAY_UDP_HIP [RFC-hip-nat-traversal-08]


ACTION 4:

New assignments in the "Notify Message Types" registry at
at http://www.iana.org/assignments/hip-parameters/hip-parameters.xhtml

Value Notify Message Type Reference
---- ------------------

60 NO_VALID_NAT_TRAVERSAL_MODE_PARAMETER [RFC-hip-nat-traversal-08]
61 CONNECTIVITY_CHECKS_FAILED [RFC-hip-nat-traversal-08]
62 MESSAGE_NOT_RELAYED [RFC-hip-nat-traversal-08]


ACTION 5:

New registry at http://www.iana.org/assignments/hip-parameters/hip-parameters.xhtml

Registry Name: HIP NAT traversal modes
Reference: [RFC-hip-nat-traversal-08]
Registration Procedures: IETF Consensus

Value Identifier name Reference
----- ----------------- ----------
0 RESERVED [RFC-hip-nat-traversal-08]
1 UDP-ENCAPSULATION [RFC-hip-nat-traversal-08]
2 ICE-STUN-UDP [RFC-hip-nat-traversal-08]

QUESTION: What is this registry's upper limit?
NOTE: "IETF Consensus" should be changed to "IETF Review," per
RFC 5226.

    (1.a)  Who is the Document Shepherd for this document?  Has the
          Document Shepherd personally reviewed this version of the
          document and, in particular, does he or she believe this
          version is ready for forwarding to the IESG for publication?

The document shepherd is Gonzalo Camarillo who believes the document is
ready for publication.

    (1.b)  Has the document had adequate review both from key WG members
          and from key non-WG members?  Does the Document Shepherd have
          any concerns about the depth or breadth of the reviews that
          have been performed?

Yes, the document has been widely reviewed.

    (1.c)  Does the Document Shepherd have concerns that the document
          needs more review from a particular or broader perspective,
          e.g., security, operational complexity, someone familiar with
          AAA, internationalization, or XML?

No concerns.

    (1.d)  Does the Document Shepherd have any specific concerns or
          issues with this document that the Responsible Area Director
          and/or the IESG should be aware of?  For example, perhaps he
          or she is uncomfortable with certain parts of the document, or
          has concerns whether there really is a need for it.  In any
          event, if the WG has discussed those issues and has indicated
          that it still wishes to advance the document, detail those
          concerns here.  Has an IPR disclosure related to this document
          been filed?  If so, please include a reference to the
          disclosure and summarize the WG discussion and conclusion on
          this issue.

No concerns. No IPR issues have been disclosed.

    (1.e)  How solid is the WG consensus behind this document?  Does it
          represent the strong concurrence of a few individuals, with
          others being silent, or does the WG as a whole understand and
          agree with it?

This document is the product of a design team. The WG reviewed the
document and there was a strong consensus.

    (1.f)  Has anyone threatened an appeal or otherwise indicated extreme
          discontent?  If so, please summarize the areas of conflict in
          separate email messages to the Responsible Area Director.  (It
          should be in a separate email because this questionnaire is
          entered into the ID Tracker.)

No.

    (1.g)  Has the Document Shepherd personally verified that the
          document satisfies all ID nits?  (See
          http://www.ietf.org/ID-Checklist.html and
          http://tools.ietf.org/tools/idnits/.)  Boilerplate checks are
          not enough; this check needs to be thorough.  Has the document
          met all formal review criteria it needs to, such as the MIB
          Doctor, media type, and URI type reviews?  If the document
          does not already indicate its intended status at the top of
          the first page, please indicate the intended status here.

The document passes ID nits.

    (1.h)  Has the document split its references into normative and
          informative?  Are there normative references to documents that
          are not ready for advancement or are otherwise in an unclear
          state?  If such normative references exist, what is the
          strategy for their completion?  Are there normative references
          that are downward references, as described in [RFC3967]?  If
          so, list these downward references to support the Area
          Director in the Last Call procedure for them [RFC3967].

There are two normative references to Internet Drafts (ICE and TURN),
both of which are supposed to be published shortly.

    (1.i)  Has the Document Shepherd verified that the document's IANA
          Considerations section exists and is consistent with the body
          of the document?  If the document specifies protocol
          extensions, are reservations requested in appropriate IANA
          registries?  Are the IANA registries clearly identified?  If
          the document creates a new registry, does it define the
          proposed initial contents of the registry and an allocation
          procedure for future registrations?  Does it suggest a
          reasonable name for the new registry?  See [RFC2434].  If the
          document describes an Expert Review process, has the Document
          Shepherd conferred with the Responsible Area Director so that
          the IESG can appoint the needed Expert during IESG Evaluation?

The document contains an IANA Considerations Section.

    (1.j)  Has the Document Shepherd verified that sections of the
          document that are written in a formal language, such as XML
          code, BNF rules, MIB definitions, etc., validate correctly in
          an automated checker?

The document does not use formal language.

    (1.k)  The IESG approval announcement includes a Document
          Announcement Write-Up.  Please provide such a Document
          Announcement Write-Up.  Recent examples can be found in the
          "Action" announcements for approved documents.  The approval
          announcement contains the following sections:

          Technical Summary
              Relevant content can frequently be found in the abstract
              and/or introduction of the document.  If not, this may be
              an indication that there are deficiencies in the abstract
              or introduction.


    This document specifies extensions to the Host Identity Protocol
    (HIP) to facilitate Network Address Translator (NAT) traversal.  The
    extensions are based on the use of the Interactive Connectivity
    Establishment (ICE) methodology to discover a working path between
    two end-hosts, and on standard techniques for encapsulating
    Encapsulating Security Payload (ESP) packets within the User Datagram
    Protocol (UDP).  This document also defines elements of procedure for
    NAT traversal, including the optional use of a HIP relay server.
    With these extensions HIP is able to work in environments that have
    NATs and provides a generic NAT traversal solution to higher-layer
    networking applications.


          Working Group Summary
              Was there anything in the WG process that is worth noting?
              For example, was there controversy about particular points
              or were there decisions where the consensus was
              particularly rough?

Nothing in particular.

          Document Quality
              Are there existing implementations of the protocol?  Have a
              significant number of vendors indicated their plan to
              implement the specification?  Are there any reviewers that
              merit special mention as having done a thorough review,
              e.g., one that resulted in important changes or a
              conclusion that the document had no substantive issues?  If
              there was a MIB Doctor, Media Type, or other Expert Review,
              what was its course (briefly)?  In the case of a Media Type
              Review, on what date was the request posted?

There are at least two independent implementations of this document.
These implementations have been tested against each other and are
interoperable. The WG did not want to request the publication of this
document before having independent interoperable implementations. That
is why we did not requested the publication of this draft before.

          Personnel
              Who is the Document Shepherd for this document?  Who is the
              Responsible Area Director?  If the document requires IANA
              experts(s), insert 'The IANA Expert(s) for the registries
              in this document are .'

The document shepherd is Gonzalo Camarillo. The responsible AD is Ralph
Droms.