1. Topic #3 DTLS/CAPWAP Interactions
Pat R. Calhoun

2. Issue 226: Transition to Join State
The original intent was to use DTLS as a “black box”
Current CAPWAP state machine requires knowledge of DTLS state machine and inspection of DTLS packets

3. Current CAPWAP State Machine
/ < \
v |d |
b |
| Idle |-->| Discovery |--->| Sulking | |
a c |
^ |aa ^ |e / \ |
| V f| v k| | |
h i j | |
/--| Join |->| Configure |-->| Image Data | | |
| g | |
| "c1, ^ ^ ^ m| ^ |l | |
| "c4 " " " | / / | /----/ |
| " " " " V |s v V |
| “ " " " o |
| “ " " " | Run |->| Reset | /
| “ " " " n p
| “ " " " "c2 ^ ^ c3" ^
\---"-----"--"---" "----" / " “ CAPWAP
~~~~"~~~~~"~~"~~~"~~~~~~~~“~~~~"~~~~~~~~~~~~"~~~"~~~~~~~~~~~~
“ " “ " " " " " DTLS
v " "n2 \"""""\ " “ v "n6,n7
/--> " W " " "
| /-| Idle | " C| Auth |--"~-"----"----->| Shutdown | \P
| | " V “ “ " /--->| |<----\ |
| |X Z| " ^ U| " " n4 " | | |
| | | " | | " " n5," | ^ | |
| | v "n1 |Y | n3“ v n8" |R |Q | |
| | | S | |
| | | Init | \->| Run |<--| Rekey | | |
| | | |-->| | | |
| | T | |
| \ / |
\ /

4. Current State Machine Text
Idle to Join (aa): This transition occurs when the WTP presents a DTLSClientHello message containing a valid cookie to the AC.
WTP: This transition is a no-op for the WTP.
AC: The AC does not maintain state information until the WTP presents a DTLS ClientHello message containing a valid cookie. Upon receipt of a DTLS ClientHello message containing a valid cookie, the AC creates session state and transitions to the Join state.

5. Proposed Solution
Only define the necessary touch points between CAPWAP/DTLS:
Establish Session Request
Session Established
Failed Session Establishment
Shutdown/Abort Session
Leave the rest of the DTLS state machine definitions stay in the DTLS RFC

6. Proposed CAPWAP State Machine #1
/==========<===============\
“ “n3
“ W
“ | DTLS Idle |===>| DTLS Run |======>| DTLS Shutdown | “
“ ^ “n1,n2,n8 ^ n6,n7“ ^ DTLS
~~”~~~”~~”~~~~~~~~~”~~~~~~~~~~~~~~~~~~~~~~~~~~~~”~~”~~~~~~~~~~~~
“ “ “ /=======+============================/ “ CAPWAP
“ “ “ “ “ “
“ “ “ “ / < \
“ c1“ v v v “c |d “ |
“ b “ |
v | Idle |-->| Discovery |--->| Sulking | “ |
“ a c “ ^
“ ^ |aa ^ |e / \ |
“ | | | | | “c3 | |
“ | | | | o | |
“ | | | | | Run |->| Reset | /
“ | | | | n p |
“ | | | | ^ ^ ^ ^ |
“ | | | | | /-----/ | | |s
| v f| v m| k| | |l v
\==> I | j
| Join |->| Configure | >| Image Data |
/ g |
| h |
\ > /
Not defining the state
transitions
Significantly reduce
the interactions!

7. Proposed CAPWAP State Machine #2
/==========<===============\
“ “n3 “
“ | DTLS |
“ ^ “n1,n2,n8 ^ n6,n7“ ^ DTLS
~~”~~~”~~”~~~~~~~~~”~~~~~~~~~~~~~~~~~~~~~~~~~~~~”~~”~~~~~~~~~~~~
“ “ “ /=======+============================/ “ CAPWAP
“ “ “ “ “ “
“ “ “ “ / < \
“ c1“ v v v “c |d “ |
“ b “ |
v | Idle |-->| Discovery |--->| Sulking | “ |
“ a c “ ^
“ ^ |aa ^ |e / \ |
“ | | | | | “c3 | |
“ | | | | o | |
“ | | | | | Run |->| Reset | /
“ | | | | n p |
“ | | | | ^ ^ ^ ^ |
“ | | | | | /-----/ | | |s
| v f| v m| k| | |l v
\==> I | j
| Join |->| Configure | >| Image Data |
/ g |
| h |
\ > /
Don’t worry about
DTLS state machine
altogether

8. New State Machine Events
Idle -> DTLS Idle
WTP: Occurs when WTP transmits a DTLSStart to the AC and starts the WaitDTLS timer
AC: Occurs when the AC receives a DTLSStart. WaitDTLS timer is started.
DTLS Idle -> Idle
WTP: Occurs when DTLSSessionEstablished notification is not received within WaitDTLS Timer
AC: Occurs when DTLSSessionEstablished notification is not received within WaitDTLS Timer
Discovery -> DTLS Idle
AC: This is an invalid state since the AC does not maintain per WTP discovery state

9. New State Machine Events
DTLS Run -> Join
WTP: Occurs when DTLSSessionEstablished command is received from DTLS. WTP transmits a Join Request
AC: Occurs when the AC receives a Join Request from the WTP, following a DTLSSessionEstablished command from DTLS.
Run -> Reset
WTP: Occurs when the WTP receives a Reset Request from the AC.
AC: Occurs when the AC transmits a Reset Request to the WTP
Reset -> DTLS Shutdown
WTP: Occurs when WTP transmits a Reset Response to the AC.
AC: Occurs after the AC receives a Reset Response to the WTP The WTP transmits a DTLSSessionShutdown notification to the DTLS stack

10. New State Machine Events
DTLS Shutdown -> Idle
WTP: Occurs when the WTP receives a DTLSSessionShutdown notification from DTLS
AC: Occurs when the AC receives a DTLSSessionShutdown confirmation notification from DTLS

11. Other Required Changes
Remove unnecessary notifications defined in sections (CAPWAP to DTLS Commands) and (DTLS to CAPWAP Commands)
Remove section (DTLS State Transitions)

12. Discussion Point
Should CAPWAP worry about the DTLS re-handshake process?
Shouldn’t this occur purely within the DTLS stack?
Certainly CAPWAP can be responsible for “configuring” the session lifetime, but is that it?
This section is another case where that requires the management of DTLS sessions within CAPWAP
If we agree this is a DTLS stack issue, then text within section (and sub-sections) should be eliminated